New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 681091 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Jan 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Integer-overflow in CPDF_PSEngine::DoOperator

Project Member Reported by ClusterFuzz, Jan 13 2017

Issue description

Cc: thestig@chromium.org tsepez@chromium.org
Components: Internals>Plugins>PDF
Labels: Test-Predator-Wrong M-56
Cc: msrchandra@chromium.org
Labels: -Test-Predator-Wrong Test-Predator-Wrong-CLs
Owner: dsinclair@chromium.org
Status: Assigned (was: Untriaged)
Find it did not provide any possible suspects.
From CL, assigning to the concern owner --
https://chromium.googlesource.com/chromium/src/+log/784971913adcc32bdb22a92da6ac237a7de88a2b..ff280f67ab2bca6f1935e6d0061d9145a24a9526?pretty=fuller

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/b9dc835015e914ded4f4f3db0bd9e95aaf7d7c03

@dsinclair -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Status: Started (was: Assigned)
https://pdfium-review.googlesource.com/c/2271/
Cc: -tsepez@chromium.org dsinclair@chromium.org
Owner: tsepez@chromium.org
Status: Assigned (was: Started)
Passing over to tsepez@ for once we get the safe numerics bit shift code.
Project Member

Comment 6 by ClusterFuzz, Jan 25 2017

ClusterFuzz has detected this issue as fixed in range 445740:445846.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5684308758233088

Fuzzer: libfuzzer_pdf_psengine_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  CPDF_PSEngine::DoOperator
  CPDF_PSProc::Execute
  CPDF_PSProc::Execute
  
Sanitizer: undefined (UBSAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=413192:413325
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=445740:445846

Minimized Testcase (8.98 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94XY9Y3GH4-uzLxrE5tJtAv4u7bWPb6ISR_vFwWx-3FaQe9Xjfyq0qeC5tkWBBEwDDT1VUgVwLo6afo1rMtBf_grpZVtyVrpepxGq3X8rpwKw-YyvEy0EHo06dGmoBrBlzz1ZpXE8hLwY5B100noG0tHiQrJ5fLtiBtytCBj8eRHay9rC518JJdFt28xqcazyCrIpBpVtmFxl1WPsoG7DaDc9doJW1YwZ-BcZz4EW-6vt5AWzbT_PLCJwjY6cfu4WgM9Xow8hOUAFzQsHrAuwBfSQxcODR-1TiklGXKP6dpgdEQpgsTHc4NGT1WMajDCvgFqHRsHz9Slazc_iDRE0-Pu6TkrV8_LOG0PaLURKR5d8yN_FI?testcase_id=5684308758233088

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment