Undefined-shift in icuLikeCompare |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6479261176430592 Fuzzer: libfuzzer_sqlite3_prepare_v2_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Undefined-shift Crash Address: Crash State: icuLikeCompare icuLikeCompare icuLikeFunc Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=458107:458176 Reproducer Testcase: https://clusterfuzz.com/download/AMIfv96-jAlyR3z01rhPqjPEesNu7CIa6NZH8oFpUQ7HIwEoghSKNHUnQNMepNHLI0vXMtkXK6kDGQwMkEbaehjw0qy9qI4HuhAnjRSB63hXZBel5sYrSaOvsuXmjJ4Ptj11LDqev-LXbWcQ774NvSMLkfc3dQ1SIFC3_IoWNl1hPVccSuWl7b0UEnnMvQR1Tjk3pOLmIdih154cr4Gl8i6qdpayhh2i5RBS3XBZj8i7yYRzPXB6ydGTBX9Th9cxsd2CbBXpBybzUWLFgcHoqjuNf_2oN8tcgdJ9pK_gfEu-RhMfNCWHWeF6-7TjbF_mgWD6aztKMDbJ6nJTKCm-U1XFu9pV9EKyWItQBr56gBCE6s37l8FXERKJkOdy9hVe8YIwcqIfxlLtKCygyp-9sfUczzgjixvRoA?testcase_id=6479261176430592 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Mar 23 2017
jungshik, looping you in because I think this is not actionable. My SQLite import replaces your patch to issue 575205 with the SQLite core team's patch to the issue. The code is calling this macro: #define SQLITE_ICU_READ_UTF8(zIn, c) \ c = *(zIn++); \ if( c>=0xc0 ){ \ c = icuUtf8Trans1[c-0xc0]; \ while( (*zIn & 0xc0)==0x80 ){ \ c = (c<<6) + (0x3f & *(zIn++)); \ } \ } If the UTF-8 is not well-formed, this will yield a busted code point, but it won't overflow the buffer (which is what issue 575205 is about). IMHO your fix was a preferred fix from the ICU point of view, but I'm not sure how important it is to get in and contest the fix they decided on, given that we're just arguing about different ways to handle invalid data.
,
Mar 24 2017
,
Mar 24 2017
Found an old email from Dan Kennedy indicating that their first order of business was not crashing. Beyond that, some other solutions were discarded because they caused problems against some versions of ICU. So they may prefer sticking with their version.
,
Apr 23 2017
ClusterFuzz testcase 6244514907029504 is flaky and no longer reproduces, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Jul 14 2017
ClusterFuzz testcase 6479261176430592 is still reproducing on tip-of-tree build (trunk). If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase. Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace. |
||||
►
Sign in to add a comment |
||||
Comment 1 by msrchandra@chromium.org
, Mar 21 2017Labels: Test-Predator-Correct-CLs M-59
Owner: sh...@chromium.org
Status: Assigned (was: Untriaged)