New issue
Advanced search Search tips

Issue 681300 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jan 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security

Blocking:
issue 62400



Sign in to add a comment

Crash in put1bitbwtile

Project Member Reported by ClusterFuzz, Jan 14 2017

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5261206945529856

Fuzzer: libfuzzer_pdf_codec_tiff_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x7f9a1b7f9813
Crash State:
  put1bitbwtile
  gtTileContig
  TIFFRGBAImageGet
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=427846:427885

Minimized Testcase (0.38 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94TbZSKSY2awpHnguOQSGXtttUlcW72H0SOkwKLD78psuQHLM5YS-pjLUWNhIiqmY7v5Rr4pBCd4hqRXNt-aoZsSD8NREafN3_P2sAMr81TBhFGDblvIBN7D7RPmhLvbWLj78YqH3WrkAtAzs2yJrtyz-EkVg?testcase_id=5261206945529856

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Project Member

Comment 1 by sheriffbot@chromium.org, Jan 14 2017

Labels: M-57
Project Member

Comment 2 by sheriffbot@chromium.org, Jan 14 2017

Labels: ReleaseBlock-Beta
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 3 by sheriffbot@chromium.org, Jan 14 2017

Labels: Pri-1
Components: Internals>Plugins>PDF
Owner: dsinclair@chromium.org
Status: Assigned (was: Untriaged)
Mind taking a look dsinclair? thestig@ is OOO. :)
Blocking: 62400
Cc: dsinclair@chromium.org
Labels: -ReleaseBlock-Beta -Security_Impact-Head -M-57 Security_Impact-None
Owner: npm@chromium.org
XFA bug, removing Release-Block label as XFA is not enabled in any branch of Chrome.

Comment 6 by npm@chromium.org, Jan 17 2017

This is caused by a problematic libtiff integer overflow problem. I've filed a bug upstream for now:
http://bugzilla.maptools.org/show_bug.cgi?id=2661
Project Member

Comment 7 by bugdroid1@chromium.org, Jan 26 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7f06e31d2b22d7e8059c983d6b6bede343e83778

commit 7f06e31d2b22d7e8059c983d6b6bede343e83778
Author: pdfium-deps-roller <pdfium-deps-roller@chromium.org>
Date: Thu Jan 26 06:25:07 2017

Roll src/third_party/pdfium/ 03de88464..5c1673db6 (2 commits).

https://pdfium.googlesource.com/pdfium.git/+log/03de88464cc8..5c1673db6dea

$ git log 03de88464..5c1673db6 --date=short --no-merges --format='%ad %ae %s'
2017-01-25 npm Calculate code_store safely in CGifLZWDecoder::Decode
2017-01-25 npm Prevent skew overflows in gtTileContig

BUG= 682628 , 681300 

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, see:
http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls

TBR=dsinclair@chromium.org

Review-Url: https://codereview.chromium.org/2651283003
Cr-Commit-Position: refs/heads/master@{#446250}

[modify] https://crrev.com/7f06e31d2b22d7e8059c983d6b6bede343e83778/DEPS

Project Member

Comment 8 by ClusterFuzz, Jan 26 2017

ClusterFuzz has detected this issue as fixed in range 446167:446253.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5261206945529856

Fuzzer: libfuzzer_pdf_codec_tiff_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x7f9a1b7f9813
Crash State:
  put1bitbwtile
  gtTileContig
  TIFFRGBAImageGet
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=427846:427885
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=446167:446253

Minimized Testcase (0.38 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94TbZSKSY2awpHnguOQSGXtttUlcW72H0SOkwKLD78psuQHLM5YS-pjLUWNhIiqmY7v5Rr4pBCd4hqRXNt-aoZsSD8NREafN3_P2sAMr81TBhFGDblvIBN7D7RPmhLvbWLj78YqH3WrkAtAzs2yJrtyz-EkVg?testcase_id=5261206945529856

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Jan 26 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5261206945529856 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 10 by sheriffbot@chromium.org, Jan 26 2017

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 11 by sheriffbot@chromium.org, May 4 2017

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment