Crash in content::WebContentsImpl::SetEncoding |
||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=4824406632431616 Fuzzer: inferno_twister Job Type: windows_syzyasan_content_shell Platform Id: windows Crash Type: UNKNOWN Crash Address: Crash State: content::WebContentsImpl::SetEncoding content::WebContentsImpl::UpdateEncoding content::RenderFrameHostImpl::OnUpdateEncoding Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=441240:441358 Minimized Testcase (0.03 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv95KMX_GmO5DbhIpsRdcNBMUzLIzSH0fWRRGItNui2GAFXxzFCXos4ee-WyqddIzD0HBFoeHzIFKgExjnpl3llVkzpwLn6K_EIEqMk2rJnszkoipr5zKI4oTzRibXhTPWSIVoE4SXf-89RI4y8RvYnqBtFHsVsU71pmHpIMUN-PDDTSdG4k2gNXyy1pNnY6OwdUNDI_-WHayBNbUu18l03fazgLpyprI6xhsELWh3VEBT6tcjjceEPfNKQZe65rwhUgKOD_PBImtmG6qLTGRcNau8jHisHSUrNa_sNs2L-ZFIHfISb_8hEOy5o97vdXB_n0wVaNxFb_envvFUvSqyeG7gQ31U5vjp_PdcL1U3FwVlrvrxzI?testcase_id=4824406632431616 <meta charset=iso-2022-cn> Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Jan 5 2017
Doesn't look related to SiteIsolation. Guessing it might be TextEncoding.
,
Jan 5 2017
,
Jan 5 2017
Issue 678444 has been merged into this issue.
,
Jan 5 2017
Issue 678473 has been merged into this issue.
,
Jan 5 2017
,
Jan 6 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/8e9a8aabbde296324fa081995177dd5aac5622e4 commit 8e9a8aabbde296324fa081995177dd5aac5622e4 Author: jinsukkim <jinsukkim@chromium.org> Date: Fri Jan 06 08:16:51 2017 Let the canonical name of invalid encoding be an empty string Returning nullptr caused crash in fuzz testing when the call sites attempts to create a string object out of it. Previously it was returning an empty string(std::string()). This change makes it work as it used to by changing the return type back to std::string. BUG= 678359 Review-Url: https://codereview.chromium.org/2619493002 Cr-Commit-Position: refs/heads/master@{#441904} [modify] https://crrev.com/8e9a8aabbde296324fa081995177dd5aac5622e4/base/i18n/character_encoding.cc [modify] https://crrev.com/8e9a8aabbde296324fa081995177dd5aac5622e4/base/i18n/character_encoding.h [modify] https://crrev.com/8e9a8aabbde296324fa081995177dd5aac5622e4/base/i18n/character_encoding_unittest.cc
,
Jan 6 2017
Issue 678961 has been merged into this issue.
,
Jan 6 2017
,
Jan 9 2017
Issue 679289 has been merged into this issue.
,
Jan 12 2017
ClusterFuzz has detected this issue as fixed in range 441510:441524. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4824406632431616 Fuzzer: inferno_twister Job Type: windows_syzyasan_content_shell Platform Id: windows Crash Type: UNKNOWN Crash Address: Crash State: content::WebContentsImpl::SetEncoding content::WebContentsImpl::UpdateEncoding content::RenderFrameHostImpl::OnUpdateEncoding Memory Tool: SYZYASAN Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=441240:441358 Fixed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=441510:441524 Minimized Testcase (0.03 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv95KMX_GmO5DbhIpsRdcNBMUzLIzSH0fWRRGItNui2GAFXxzFCXos4ee-WyqddIzD0HBFoeHzIFKgExjnpl3llVkzpwLn6K_EIEqMk2rJnszkoipr5zKI4oTzRibXhTPWSIVoE4SXf-89RI4y8RvYnqBtFHsVsU71pmHpIMUN-PDDTSdG4k2gNXyy1pNnY6OwdUNDI_-WHayBNbUu18l03fazgLpyprI6xhsELWh3VEBT6tcjjceEPfNKQZe65rwhUgKOD_PBImtmG6qLTGRcNau8jHisHSUrNa_sNs2L-ZFIHfISb_8hEOy5o97vdXB_n0wVaNxFb_envvFUvSqyeG7gQ31U5vjp_PdcL1U3FwVlrvrxzI?testcase_id=4824406632431616 <meta charset=iso-2022-cn> See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
||||
►
Sign in to add a comment |
||||
Comment 1 by msrchandra@chromium.org
, Jan 5 2017Components: Internals>Sandbox>SiteIsolation
Labels: Test-Predator-Correct-CLs
Owner: jinsuk...@chromium.org
Status: Assigned (was: Untriaged)