New issue
Advanced search Search tips

Issue 697451 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Oct 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: ----
Type: Bug-Security

Blocking:
issue 62400



Sign in to add a comment

Heap-buffer-overflow in GetWord_LSBFirst

Project Member Reported by ClusterFuzz, Mar 1 2017

Issue description

Comment 1 by vakh@chromium.org, Mar 1 2017

Cc: tsepez@chromium.org
Components: Internals>Plugins>PDF
Owner: dsinclair@chromium.org
Status: Assigned (was: Untriaged)
dsinclair@ -- can you please take a look and triage further? Thanks.
Blocking: 62400
Labels: -Security_Impact-Head Security_Impact-None
XFA is not enabled in any branch of Chrome.
Project Member

Comment 3 by ClusterFuzz, Mar 22 2017

Labels: OS-Mac
Project Member

Comment 4 by ClusterFuzz, Jul 30 2017

Detailed report: https://clusterfuzz.com/testcase?key=5619551613222912

Fuzzer: pdf_codec_bmp_fuzzer
Job Type: libfuzzer_chrome_asan
Crash Type: Heap-buffer-overflow READ 1
Crash Address: 0x60a0000015dd
Crash State:
  GetWord_LSBFirst
  BMPDecompressor::ReadHeader
  CCodec_BmpModule::ReadHeader
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5619551613222912


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
Project Member

Comment 5 by ClusterFuzz, Jul 31 2017

Detailed report: https://clusterfuzz.com/testcase?key=5619551613222912

Fuzzer: pdf_codec_bmp_fuzzer
Job Type: libfuzzer_chrome_asan
Crash Type: Heap-buffer-overflow READ 1
Crash Address: 0x60a0000015dd
Crash State:
  GetWord_LSBFirst
  BMPDecompressor::ReadHeader
  CCodec_BmpModule::ReadHeader
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=398287:399171

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5619551613222912


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
Owner: rharrison@chromium.org

Comment 7 by mmoroz@chromium.org, Sep 30 2017

We're going to temporarily disable this fuzz target on ClusterFuzz side, as it is wasting CPU cycles due to frequent crashing. We might not have crash stats from CF after that, but the target will stay in the repository and available for local reproducing and testing bug fixes.

https://chromium-review.googlesource.com/c/chromium/src/+/692525
Project Member

Comment 8 by ClusterFuzz, Oct 1 2017

Labels: Test-Predator-AutoComponents
Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.
Status: Fixed (was: Assigned)
No long reproduces on HEAD. Related code replaced as part of a bug fix in https://pdfium-review.googlesource.com/c/pdfium/+/15210
Project Member

Comment 10 by sheriffbot@chromium.org, Oct 6 2017

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 11 by ClusterFuzz, Oct 7 2017

ClusterFuzz has detected this issue as fixed in range 506787:506835.

Detailed report: https://clusterfuzz.com/testcase?key=5619551613222912

Fuzzer: pdf_codec_bmp_fuzzer
Job Type: libfuzzer_chrome_asan
Crash Type: Heap-buffer-overflow READ 1
Crash Address: 0x60a0000015dd
Crash State:
  GetWord_LSBFirst
  BMPDecompressor::ReadHeader
  CCodec_BmpModule::ReadHeader
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=398287:399171
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=506787:506835

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5619551613222912

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 12 by ClusterFuzz, Oct 7 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 5619551613222912 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Cc: npm@chromium.org

Comment 14 by mmoroz@google.com, Oct 18 2017

Cc: mmoroz@chromium.org
Thanks for fixing! I guess we can enabled fuzzer by doing revert (or partial revert?) of https://chromium-review.googlesource.com/c/chromium/src/+/692525 ?
Project Member

Comment 15 by bugdroid1@chromium.org, Oct 23 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f5d9849db58316149f40bdf9c36d040110d5f991

commit f5d9849db58316149f40bdf9c36d040110d5f991
Author: Ryan Harrison <rharrison@chromium.org>
Date: Mon Oct 23 20:51:39 2017

Re-enable pdf_codec_bmp_fuzzer

The bug that it was disabled for has been resolved.

BUG= chromium:697451 

Change-Id: Id944cf685fc2e3078aa828b31789a25f1b1f1719
Reviewed-on: https://chromium-review.googlesource.com/733787
Reviewed-by: Max Moroz <mmoroz@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Cr-Commit-Position: refs/heads/master@{#510909}
[modify] https://crrev.com/f5d9849db58316149f40bdf9c36d040110d5f991/pdf/pdfium/fuzzers/BUILD.gn

Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components
Project Member

Comment 17 by sheriffbot@chromium.org, Jan 12 2018

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment