New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 699357 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Apr 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

parsed_output == double_parsed_output. Parser/Writer mismatch.

Project Member Reported by ClusterFuzz, Mar 8 2017

Issue description

Components: Infra>Git
Labels: Test-Predator-Correct-CLs M-59
Owner: aizatsky@chromium.org
Status: Assigned (was: Untriaged)
Find it result:
================
Git blame below is NOT necessarily who introduced the crash nor the owner for it. Please check the code before assigning to anyone.(No CL in the regression range changed the crashing files.) 

Author: mostynb@opera.com
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/901a5e3835718e8872f38af32d65fce7ea3fcbeb
Time: Mon Apr 08 23:26:25 2013
The CL last changed line 221 of file debugger_posix.cc, which is stack frame 7. 

Author: brettw@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/58580359a452cb7c3b9580edc0843c3ab3d158df
Time: Tue Oct 26 04:07:50 2010
The CL last changed line 251 of file debugger_posix.cc, which is stack frame 8. 

Author: rch@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/82d89abc03ea6fd6b9258f0e57be0290b33d7eb1
Time: Fri Feb 28 18:25:34 2014
The CL last changed line 759 of file logging.cc, which is stack frame 9. 

Author: aizatsky
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/022c9c2dd56926d03f2dd21036ebde0da869ee7b
Time: Mon Oct 31 21:42:21 2016
The CL last changed line 51 of file correctness_fuzzer.cc, which is stack frame 10.
====================
Possible suspect from the above CL list:
Review-Url: https://codereview.chromium.org/2449323004
aizatsky@: Could you please take a look into this if its related to your change.
The CL that introduced the fuzzer notes: "It's probably worth pointing out that the base json parser is not meant to be security hardened and handle invalid json. So depending on what kind of fuzzing you're doing we may or may not want to act on the results. See https://bugs.chromium.org/p/chromium/issues/detail?id=644664#c5."

It's unclear from this report whether the behavior encountered is expected.
Even if the fuzzer isn't secure, it is probably assumed that it is correct. I.e. if you serialize data, read it back and serialize again, then it should match. This is what the fuzzer checks.
Project Member

Comment 4 by ClusterFuzz, Apr 18 2017

ClusterFuzz has detected this issue as fixed in range 464993:465034.

Detailed report: https://clusterfuzz.com/testcase?key=4534161798070272

Fuzzer: libfuzzer_base_json_correctness_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  parsed_output == double_parsed_output. Parser/Writer mismatch.
  base::debug::DebugBreak
  _start
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=455091:455226
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=464993:465034

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv96RKph3lMWZai_nU_JqKJqzj8UNOejlmERI12Mk9I_0XNvsYhnUSJBSxp6pImydYp4UULjTuIddRHNcWTtx5gkGNxnxbthN7v7-USYOfa_F6OOUSlUiUCToNeGbQuo7pHZ0561r0my_HiLafHK0drcYLwo6544FiLTail2UNl6VDMzlzZb778uZHIsx2xLMHgLTscf5-q37s0c7z-C7i0AxMwC3s_EjcVj8l9FfSt8haNoQYCDqpGeGflk7HH0icxSwUnIAz7XslbrjepScrhT6NsO1YUiUof2e_MtgOlnIdatSacCKqjyUaEC752qzegNbUsujNGf6M7CErG3PppUbllQRRRr9vdG8uXmN_fkFkah9vbk?testcase_id=4534161798070272


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Apr 18 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 4534161798070272 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment