New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 678359 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Jan 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows , All
Pri: 1
Type: Bug



Sign in to add a comment

Crash in content::WebContentsImpl::SetEncoding

Project Member Reported by ClusterFuzz, Jan 4 2017

Issue description

Cc: msrchandra@chromium.org
Components: Internals>Sandbox>SiteIsolation
Labels: Test-Predator-Correct-CLs
Owner: jinsuk...@chromium.org
Status: Assigned (was: Untriaged)
Assigning to the concern owner from find it results --
The result is a list of CLs that change the crashed files. 

Author: jinsukkim
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/79df88ae0437499f21dd82976ca24a0c6f2d11c7
Time: Wed Jan 04 06:26:15 2017
Lines 5160 of file web_contents_impl.cc which potentially caused crash are changed in this cl (frame #3, "content_shell!content::WebContentsImpl::SetEncoding+0x3b").
Minimum distance from crash line to modified line: 0. (file: web_contents_impl.cc, crashed on: 5160, modified: 5160).

@jinsukkim -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Comment 2 by creis@chromium.org, Jan 5 2017

Components: -Internals>Sandbox>SiteIsolation Blink>TextEncoding
Doesn't look related to SiteIsolation.  Guessing it might be TextEncoding.
Cc: jinsuk...@chromium.org
 Issue 678377  has been merged into this issue.
 Issue 678444  has been merged into this issue.
 Issue 678473  has been merged into this issue.
Status: Started (was: Assigned)
Project Member

Comment 7 by bugdroid1@chromium.org, Jan 6 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8e9a8aabbde296324fa081995177dd5aac5622e4

commit 8e9a8aabbde296324fa081995177dd5aac5622e4
Author: jinsukkim <jinsukkim@chromium.org>
Date: Fri Jan 06 08:16:51 2017

Let the canonical name of invalid encoding be an empty string

Returning nullptr caused crash in fuzz testing when the call sites
attempts to create a string object out of it. Previously it was
returning an empty string(std::string()). This change makes it work
as it used to by changing the return type back to std::string.

BUG= 678359 

Review-Url: https://codereview.chromium.org/2619493002
Cr-Commit-Position: refs/heads/master@{#441904}

[modify] https://crrev.com/8e9a8aabbde296324fa081995177dd5aac5622e4/base/i18n/character_encoding.cc
[modify] https://crrev.com/8e9a8aabbde296324fa081995177dd5aac5622e4/base/i18n/character_encoding.h
[modify] https://crrev.com/8e9a8aabbde296324fa081995177dd5aac5622e4/base/i18n/character_encoding_unittest.cc

 Issue 678961  has been merged into this issue.
Labels: OS-All
Status: Fixed (was: Started)
 Issue 679289  has been merged into this issue.
Project Member

Comment 11 by ClusterFuzz, Jan 12 2017

ClusterFuzz has detected this issue as fixed in range 441510:441524.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4824406632431616

Fuzzer: inferno_twister
Job Type: windows_syzyasan_content_shell
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 
Crash State:
  content::WebContentsImpl::SetEncoding
  content::WebContentsImpl::UpdateEncoding
  content::RenderFrameHostImpl::OnUpdateEncoding
  
Memory Tool: SYZYASAN

Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=441240:441358
Fixed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=441510:441524

Minimized Testcase (0.03 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95KMX_GmO5DbhIpsRdcNBMUzLIzSH0fWRRGItNui2GAFXxzFCXos4ee-WyqddIzD0HBFoeHzIFKgExjnpl3llVkzpwLn6K_EIEqMk2rJnszkoipr5zKI4oTzRibXhTPWSIVoE4SXf-89RI4y8RvYnqBtFHsVsU71pmHpIMUN-PDDTSdG4k2gNXyy1pNnY6OwdUNDI_-WHayBNbUu18l03fazgLpyprI6xhsELWh3VEBT6tcjjceEPfNKQZe65rwhUgKOD_PBImtmG6qLTGRcNau8jHisHSUrNa_sNs2L-ZFIHfISb_8hEOy5o97vdXB_n0wVaNxFb_envvFUvSqyeG7gQ31U5vjp_PdcL1U3FwVlrvrxzI?testcase_id=4824406632431616
<meta charset=iso-2022-cn>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment