Issue metadata
Sign in to add a comment
|
Heap-buffer-overflow in bmp_decode_rle4 |
||||||||||||||||||||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=4599350778134528 Fuzzer: libfuzzer_pdf_codec_bmp_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x7f1f3d85e490 Crash State: bmp_decode_rle4 bmp_decode_image CCodec_BmpModule::LoadImage Sanitizer: address (ASAN) Recommended Security Severity: High Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=453665:453694 Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97BFpTLkatLrx84Sd_7f80zisw5tJjO63S2nlw4lO52tiDlavepqs9e_1M7-DdTE0zBRofXMQZMVwZ7K6f5JtRINeOIUnSrdjJl7Ow5jLYivqqrTbHMF1mYGqkXvZIbzcvieZX2jF2wrRHG11OAMKve-ZdX-ZSgzMjqScRY1m3ybqPAzjZAF5RtxoioHQQzKuS0sh7GPNbPDKP-H_FztTHGzdNgf2c9JUvEnLbvW-q6hiCquw3hyQCU2tVOpGc4nkzwZdjitu3wxXhlYWfpuWIbydRFMuHtugdTMwierW9sevF1fW20HtqmMiCpMgvqCjZV4QDl5AXIrIoLij143QLTxxuNhcdpph1G4aHgTnZZy0uZ-oQ?testcase_id=4599350778134528 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Mar 2 2017
XFA is not enabled on any branch of Chrome.
,
Mar 15 2017
ClusterFuzz has detected this issue as fixed in range 456972:456997. Detailed report: https://clusterfuzz.com/testcase?key=4599350778134528 Fuzzer: libfuzzer_pdf_codec_bmp_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x7f1f3d85e490 Crash State: bmp_decode_rle4 bmp_decode_image CCodec_BmpModule::LoadImage Sanitizer: address (ASAN) Recommended Security Severity: High Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=453665:453694 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=456972:456997 Reproducer Testcase: https://clusterfuzz.com/download/AMIfv97BFpTLkatLrx84Sd_7f80zisw5tJjO63S2nlw4lO52tiDlavepqs9e_1M7-DdTE0zBRofXMQZMVwZ7K6f5JtRINeOIUnSrdjJl7Ow5jLYivqqrTbHMF1mYGqkXvZIbzcvieZX2jF2wrRHG11OAMKve-ZdX-ZSgzMjqScRY1m3ybqPAzjZAF5RtxoioHQQzKuS0sh7GPNbPDKP-H_FztTHGzdNgf2c9JUvEnLbvW-q6hiCquw3hyQCU2tVOpGc4nkzwZdjitu3wxXhlYWfpuWIbydRFMuHtugdTMwierW9sevF1fW20HtqmMiCpMgvqCjZV4QDl5AXIrIoLij143QLTxxuNhcdpph1G4aHgTnZZy0uZ-oQ?testcase_id=4599350778134528 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Mar 15 2017
ClusterFuzz testcase 4599350778134528 is verified as fixed, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Mar 15 2017
,
Mar 15 2017
,
Jun 21 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by vakh@chromium.org
, Mar 2 2017Components: Internals>Plugins>PDF
Owner: dsinclair@chromium.org
Status: Assigned (was: Untriaged)