New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 669407 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Nov 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in base::debug::DebugBreak

Project Member Reported by ClusterFuzz, Nov 29 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6480969831022592

Fuzzer: libfuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x03e900006ce1
Crash State:
  base::debug::DebugBreak
  net::FtpNetworkTransaction::GetRequestPathForFtpCommand
  net::FtpNetworkTransaction::DoCtrlWriteSIZE
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=433648:433747

Minimized Testcase (1.03 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94hLICcQxuIciiBkVLRcinu7LkHzPCde00S9aUKayVOzPNP9k-ZdhAat74HsyCFCTdr-1gWHxgeIJ0AkYVoVFap-Dqaztmu3n_yv7yHw6rzLjC9HrhVFV9WQOeKqdDOPHTSgiuYUXRBKNEPX9o6fRr2HO6eDA?testcase_id=6480969831022592

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org
Components: Infra>Git
Labels: Test-Predator-Wrong-CLs
Owner: mmenke@chromium.org
Status: Assigned (was: Untriaged)
Unable to find the possible suspect using Find it.
From Regression range assigning to the concern owner, below is the regressed CL --
https://chromium.googlesource.com/chromium/src/+log/2e790171a1806ea15a81ef9bc2ab87ec93aabb92..c1cab294711bca021f9e21a06e9183ca88b8c62a?pretty=fuller

Suspecting the following Commit #
https://chromium.googlesource.com/chromium/src/+/a7da0714bb1e387b30298047a9fa81c0ed2a2d13

@mmenke -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Comment 2 by mmenke@chromium.org, Nov 29 2016

That fuzzer type has to be wrong.  The detailed bug report correctly shows "net_url_request_ftp_fuzzer" is the binary that was executed.

Comment 3 by mmenke@chromium.org, Nov 29 2016

Status: Fixed (was: Assigned)
Project Member

Comment 4 by bugdroid1@chromium.org, Nov 29 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2d3fc642169b3997c1cb7d2169e0c9c6c98c21e8

commit 2d3fc642169b3997c1cb7d2169e0c9c6c98c21e8
Author: mmenke <mmenke@chromium.org>
Date: Tue Nov 29 18:58:53 2016

Fix yet another silly DCHECK in the FTP code.

The code was allowing CRs or LFs in remote paths, but DCHECKing that
commands including paths don't contain them.

This CL makes the request fail if a remote path contains either
character.

BUG= 669407 

Review-Url: https://codereview.chromium.org/2538773002
Cr-Commit-Position: refs/heads/master@{#435045}

[modify] https://crrev.com/2d3fc642169b3997c1cb7d2169e0c9c6c98c21e8/net/ftp/ftp_network_transaction.cc
[modify] https://crrev.com/2d3fc642169b3997c1cb7d2169e0c9c6c98c21e8/net/ftp/ftp_network_transaction_unittest.cc

Project Member

Comment 5 by ClusterFuzz, Nov 30 2016

ClusterFuzz has detected this issue as fixed in range 435013:435078.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6480969831022592

Fuzzer: libfuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x03e900006ce1
Crash State:
  base::debug::DebugBreak
  net::FtpNetworkTransaction::GetRequestPathForFtpCommand
  net::FtpNetworkTransaction::DoCtrlWriteSIZE
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=433648:433747
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=435013:435078

Minimized Testcase (1.03 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94hLICcQxuIciiBkVLRcinu7LkHzPCde00S9aUKayVOzPNP9k-ZdhAat74HsyCFCTdr-1gWHxgeIJ0AkYVoVFap-Dqaztmu3n_yv7yHw6rzLjC9HrhVFV9WQOeKqdDOPHTSgiuYUXRBKNEPX9o6fRr2HO6eDA?testcase_id=6480969831022592

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment