New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 680899 link

Starred by 1 user
Status: WontFix
Owner:
palmer@chromium.org
Closed: Feb 2017
Cc:
█ msrchandra@chromium.org
haraken@chromium.org
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

count <= base::kGenericMaxDirectMapped / sizeof(T) in PartitionAllocator.h

Project Member Reported by ClusterFuzz, Jan 13 2017 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4788431998943232

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_ubsan_vptr_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  count <= base::kGenericMaxDirectMapped / sizeof(T) in PartitionAllocator.h
  blink::CSSTokenizer::CSSTokenizer
  blink::CSSParserImpl::parseStyleSheet
  
Sanitizer: undefined (UBSAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_vptr_chrome&range=443258:443393

Minimized Testcase (0.31 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv950MU8mqtQY1j9j0SDnS4_RwIQI-GVeUJGDjlph67dLeH6YKlLChGMQahspYxYA4IZpiA1ZinyvAz5xI8tmYXcc6o_CzvWeNHSA19utf1dNRfOWcvc6lYdikMiUnATL5QVs8RlBChrrmDsgcnYFBtdLTke4VDIBt1_SY6qEun1cz3bW8K6oWjNVtGp1mCblojxaOuZssIPn6MjbMGcF66riTC5Lopw40yq4YxGGC-Ev7spvyIqCjpfvtXQCR4_vnwdRlFbk70SsrcOadFhywMBtDhOhCSiiOJUCbMZZN4Oo-Oei4_8W4ZoXj79rk7_NYyGidC6VfCGxOwp1eiXN-F9NA7ghIaNVb4jhA7bYoM13HzucybrVOkj4zGx7bYtAFFPuTqrc451pfUsNpyHLZnVbdZv2ww?testcase_id=4788431998943232
<script>
var styleElement = document.createElement('style');
var str="z";
for (var i = 0; i < 16; i++) {
    str += str;
}
for (var i = -2; i < 6+(129<<5); i++){
    var txt = document.createTextNode(str);
    styleElement.appendChild(txt);
}
document.getElementsByTagName('head')[0].appendChild(styleElement);
  </script>


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by msrchandra@chromium.org, Jan 13 2017

Cc: msrchandra@chromium.org
Labels: Test-Predator-Wrong
Owner: palmer@chromium.org
Status: Assigned (was: Untriaged)
Find it and CL did not provide any possible suspects.
Using Code Search for the file, "PartitionAllocator.h" assigning to the concern owner who might be related.

@palmer -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Comment 2 by palmer@chromium.org, Feb 8 2017

Cc: haraken@chromium.org
Status: WontFix (was: Assigned)
This is working as intended: the test case causes an insane/unsafe allocation size, and the CHECK_LE in the code detects that:

  template<typename T>
  static size_t maxElementCountInBackingStore() {
    return base::kGenericMaxDirectMapped / sizeof(T);
  }

  template <typename T>
  static size_t quantizedSize(size_t count) {
    CHECK_LE(count, maxElementCountInBackingStore<T>());
    return PartitionAllocActualSize(WTF::Partitions::bufferPartition(),
                                    count * sizeof(T));
  }
Project Member

Comment 3 by ClusterFuzz, Jun 2 2017 

ClusterFuzz has detected this issue as fixed in range 476474:476520.

Detailed report: https://clusterfuzz.com/testcase?key=4788431998943232

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_ubsan_vptr_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  count <= base::kGenericMaxDirectMapped / sizeof(T) in PartitionAllocator.h
  blink::CSSTokenizer::CSSTokenizer
  blink::CSSParserImpl::parseStyleSheet
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=443258:443393
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=476474:476520

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4788431998943232


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
►

Sign in to add a comment