This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

+tsepez: looks like thestig might have introduced this one in https://codereview.chromium.org/2456553002. Do you mind taking a look?

Justin, this is the PDF-copy of safe math, does this ring any bells for something you might have fixed in //base ?

Sorry, I can't imagine how this could be getting an uninitialized value, since the initialization and then an assignment are immediately preceding the failing line. Could there be an msan bug here?

Any updates on this?  We're planning on shipping to Beta tomorrow on 12/8

This is part of XFA and not enabled on any branch of Chrome.

ClusterFuzz has detected this issue as fixed in range 443057:443122.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4645927739719680

Fuzzer: libfuzzer_pdf_codec_tiff_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  tiff_read
  OJPEGReadHeaderInfoSecTablesAcTable
  OJPEGReadHeaderInfoSec
  
Sanitizer: memory (MSAN)

Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=427783:427885
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=443057:443122

Minimized Testcase (0.50 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96jdmog8BbbFQdK1okVH9YpFMtXs6iU8AV4BvgpR7Jl1Pj7Ka5HR8gEKJaPAewCsn7LHZXngM_Ux2sO27_GEgKpZsY8DMMsaYI4dRSIrk3eMNViT7tHNCkBjQn2ywSMnt4rCPCR22O_hmYesFuBVyi0MDWpKw?testcase_id=4645927739719680

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4645927739719680 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot