New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 675111 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Jan 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 3
Type: Bug



Sign in to add a comment

Crash in base::debug::DebugBreak

Project Member Reported by ClusterFuzz, Dec 16 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5094198710894592

Fuzzer: libfuzzer_net_url_request_ftp_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x03e900007d72
Crash State:
  base::debug::DebugBreak
  net::FtpUtil::UnixFilePathToVMS
  net::FtpNetworkTransaction::GetRequestPathForFtpCommand
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=433648:433747

Minimized Testcase (2.05 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94mUrRGLskxOaQeAnId1oo9xVZOtq-ZNh1DDSIXvVTRNHNa2L5slPhjcYYI0TvrkH75Jrrv4ulI2rB3LU1gis3rThM8X2wrfkffJPTsgs1xpksXuaeGT2n_iSVeoIjB-KJeN2x7Hp5mXUdXnUNkcikBVls__g?testcase_id=5094198710894592

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org
Components: Infra>Git
Labels: Test-Predator-Wrong-CLs
Owner: mmenke@chromium.org
Status: Assigned (was: Untriaged)
Find it did not provide any possible suspect.
From CL assigning it to the concern owner --
https://chromium.googlesource.com/chromium/src/+log/2e790171a1806ea15a81ef9bc2ab87ec93aabb92..c1cab294711bca021f9e21a06e9183ca88b8c62a?pretty=fuller

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/a7da0714bb1e387b30298047a9fa81c0ed2a2d13

@mmenke -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Components: -Infra>Git Internals>Network
Labels: -Pri-1 Pri-3
Not a security bug, and looks like we do something sane in this case, so lowering priority.
Components: -Internals>Network Internals>Network>FTP
Status: Fixed (was: Assigned)
Fixed, not worth a merge, since the fix was just to remove the DCHECK (And included another minor fix as well, also not worth merging)
Project Member

Comment 5 by bugdroid1@chromium.org, Jan 4 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/dbb6723c81a3d595aa3cc593acac9bb93b328398

commit dbb6723c81a3d595aa3cc593acac9bb93b328398
Author: mmenke <mmenke@chromium.org>
Date: Wed Jan 04 19:09:04 2017

Fix a pair of bugs in UNIX->VMS path conversion.

In particular:
* Fix conversion of UNIX file name "/////file" and "////" as a UNIX
  path.  Both of these were broken, due to the same bug.
* Remove a DCHECK that would trigger on "//" as a file name. It's a
  valid UNIX path, if not a file name, and can still be passed through
  the file name conversion code.  Since there's no code to prevent
  that from happening, and the conversion code handles "/", the DCHECK
  made no sense.

BUG= 675111 

Review-Url: https://codereview.chromium.org/2610973002
Cr-Commit-Position: refs/heads/master@{#441423}

[modify] https://crrev.com/dbb6723c81a3d595aa3cc593acac9bb93b328398/net/ftp/ftp_util.cc
[modify] https://crrev.com/dbb6723c81a3d595aa3cc593acac9bb93b328398/net/ftp/ftp_util_unittest.cc

Project Member

Comment 6 by ClusterFuzz, Jan 5 2017

ClusterFuzz has detected this issue as fixed in range 441418:441502.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5094198710894592

Fuzzer: libfuzzer_net_url_request_ftp_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x03e900007d72
Crash State:
  base::debug::DebugBreak
  net::FtpUtil::UnixFilePathToVMS
  net::FtpNetworkTransaction::GetRequestPathForFtpCommand
  
Sanitizer: address (ASAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=433648:433747
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=441418:441502

Minimized Testcase (2.05 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94mUrRGLskxOaQeAnId1oo9xVZOtq-ZNh1DDSIXvVTRNHNa2L5slPhjcYYI0TvrkH75Jrrv4ulI2rB3LU1gis3rThM8X2wrfkffJPTsgs1xpksXuaeGT2n_iSVeoIjB-KJeN2x7Hp5mXUdXnUNkcikBVls__g?testcase_id=5094198710894592

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment