New issue
Advanced search Search tips

Issue 706525 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Mar 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug-Security



Sign in to add a comment

Crash in __tsan::CallUserSignalHandler

Project Member Reported by ClusterFuzz, Mar 29 2017

Issue description

Comment 1 by ta...@google.com, Mar 30 2017

Owner: tsepez@chromium.org
Status: Assigned (was: Untriaged)
This also looks similar to #706520 and #706520 (even though this one is from tsan). tsepez@, could you take a look since you are assigned on #706520.

Comment 2 by ta...@google.com, Mar 30 2017

Components: Internals>Plugins>PDF
Project Member

Comment 3 by sheriffbot@chromium.org, Mar 30 2017

Labels: Pri-2

Comment 4 by tsepez@chromium.org, Mar 30 2017

Cc: dsinclair@chromium.org
Project Member

Comment 5 by ClusterFuzz, Mar 31 2017

ClusterFuzz has detected this issue as fixed in range 460910:460935.

Detailed report: https://clusterfuzz.com/testcase?key=6552878794932224

Fuzzer: tokenfuzz_pdf_april16
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x7bc000040000
Crash State:
  __tsan::CallUserSignalHandler
  rtl_sigaction
  CFX_ClipRgn::IntersectMaskRect
  
Sanitizer: thread (TSAN)

Recommended Security Severity: Low

Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=460400:460403
Fixed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=460910:460935

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv94YTkOJODcCMRYDA7oJe3Y1zYUXtdjpE0YSk5nXyNWXyvmoSezafo4IzpUR2jUYJOAB3pg7eEn65sDyrJND-phTBAjYr9xhnu3eVjmX2_Dl2f9GzrNyv5d9dM7_McihD0oMMBK6RuqTbhOWtfNZudVB0Fuc7iPWWyKZGoVNNddKM5mYWuwbuioSEck-jcSng283YRrwiPykO5pFN05dam8XhqcjPZ1FkJ3ZkUFLFQgmHa_AEP4Pws_2QjN401Sha6VTIZqvc918OP5xNx0m0bX4Sw1E2G8Hx7NCbOcMYKdKVGQQgv4yfSfmyOEJtl_7Rg9jcdtNrJngQwh06Q-wkGD2yYTHHey92HgLeoi5oEp7eu2t2msvBVyUaAiJA42_zEfaqo_fLfjCd5pVR4hDR__uFQVztQ?testcase_id=6552878794932224


Additional requirements: Requires Gestures

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Mar 31 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6552878794932224 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 7 by sheriffbot@chromium.org, Mar 31 2017

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 8 by sheriffbot@chromium.org, Jul 7 2017

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment