Integer-overflow in computeYMD |
||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=6037093483806720 Fuzzer: libfuzzer_sqlite3_prepare_v2_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: computeYMD computeYMD_HMS strftimeFunc Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=415587:415619 Minimized Testcase (0.56 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94_yIaIsJHjx8TLTqFbea0KJ8s40MzXSWhwk2_YAyzcGPw8sS-UYG2MJ7r8YeAktafix_gq1_uMwnksM8aMVYBMwUU1VDrJHs0U91micDtsxOgm3W7GDQsUc7zvJbUq3eZZBYPReVF8qSVX2pIAFLhBK7b3pg?testcase_id=6037093483806720 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Jan 18 2017
This is similar to issue 668017 , due to excessive values in strftime() (argv[1] is passed to the same date parser as date uses). The SQLite strftime() function returns results in a string via snprintf(), so I don't think there is a way to corrupt memory or anything resulting from it, you'll just get poor outputs.
,
Mar 21 2017
ClusterFuzz has detected this issue as fixed in range 458107:458176. Detailed report: https://clusterfuzz.com/testcase?key=6037093483806720 Fuzzer: libfuzzer_sqlite3_prepare_v2_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: computeYMD computeYMD_HMS strftimeFunc Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=415587:415619 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=458107:458176 Reproducer Testcase: https://clusterfuzz.com/download/AMIfv96BmKuzgYkwnPsdeGUrzKfk9So_5uNglufC-pklFgTMIML3a_K325-Tgj5s5IW8O1FkFVMNtszpWwB7DLWqg62YOjFZgUQc0dpKnLKgBF0JTeww991BYvRspvoG4KyjI9KDGGcOBs8Em4-xIml4NRhTDcaPQX4hZvVHY1_Nmw9scBBXBmZaiRGDThzwwmOK15aA-tWW87qB1_BC-XH5A_FWUOwACvoWcKtjYzw243rUYfl2znswLvL8bNfa4cuR1rFGGc6tgqimhvEFpAP_cqwYvMnC1LtITp1jSyxOiZsiRdNdWGqrZTsFpRHkIbPN31dDO7EyDLUzkwc0LXYnPaNc7B3tADHnQGim4eBNAeB3zqXZmnY?testcase_id=6037093483806720 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Mar 21 2017
ClusterFuzz testcase 6037093483806720 is verified as fixed, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||
►
Sign in to add a comment |
||
Comment 1 by msrchandra@chromium.org
, Dec 26 2016Labels: Test-Predator-Wrong-CLs
Owner: sh...@chromium.org
Status: Assigned (was: Untriaged)