Undefined-shift in CJBig2_HuffmanTable::InitCodes |
||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6656313099812864 Fuzzer: libfuzzer_pdf_codec_jbig2_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Undefined-shift Crash Address: Crash State: CJBig2_HuffmanTable::InitCodes CJBig2_HuffmanTable::ParseFromCodedBuffer CJBig2_HuffmanTable::CJBig2_HuffmanTable Sanitizer: undefined (UBSAN) Reproducer Testcase: https://clusterfuzz.com/download/AMIfv96ZloAOOvUJPqUh7Ht4YK807i_jBJwUWXkIP_JW3WpDYCyZUmnIYb7wN79WSMKHwu5g392duuJF5G7KxD-1T-rp4IoKbEASYKGK8ccCm_YwodpfydSWpnj_ZeMEW8dW6onOn2rZXvlSxiLDFXo38VTWLHQGqke6h3-Bdp9vTArnfFWtBqqES7RUvmDSx7GcigedVxMs1H4aU40v0WeIqC_E-2jwyFKhGJCu9I7uQTKjFqSK30h3afxSt0DqOgGmQgze5fQVWaoKQQLauqLyab51X3QMZkssKBEuB5-STbaWSY3eyW5M-WFuQKjBfIvoNkxOE4wUjeq_I-xNE4Nd-rtLNKD2lWiBs9duVySjMbqWSWGUGfQ?testcase_id=6656313099812864 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Apr 10 2017
,
Apr 10 2017
,
Apr 12 2017
ClusterFuzz has detected this issue as fixed in range 463671:463725. Detailed report: https://clusterfuzz.com/testcase?key=6656313099812864 Fuzzer: libfuzzer_pdf_codec_jbig2_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Undefined-shift Crash Address: Crash State: CJBig2_HuffmanTable::InitCodes CJBig2_HuffmanTable::ParseFromCodedBuffer CJBig2_HuffmanTable::CJBig2_HuffmanTable Sanitizer: undefined (UBSAN) Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=463671:463725 Reproducer Testcase: https://clusterfuzz.com/download/AMIfv96ZloAOOvUJPqUh7Ht4YK807i_jBJwUWXkIP_JW3WpDYCyZUmnIYb7wN79WSMKHwu5g392duuJF5G7KxD-1T-rp4IoKbEASYKGK8ccCm_YwodpfydSWpnj_ZeMEW8dW6onOn2rZXvlSxiLDFXo38VTWLHQGqke6h3-Bdp9vTArnfFWtBqqES7RUvmDSx7GcigedVxMs1H4aU40v0WeIqC_E-2jwyFKhGJCu9I7uQTKjFqSK30h3afxSt0DqOgGmQgze5fQVWaoKQQLauqLyab51X3QMZkssKBEuB5-STbaWSY3eyW5M-WFuQKjBfIvoNkxOE4wUjeq_I-xNE4Nd-rtLNKD2lWiBs9duVySjMbqWSWGUGfQ?testcase_id=6656313099812864 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Apr 27 2018
The following revision refers to this bug: https://pdfium.googlesource.com/pdfium/+/ccd9426e7127373c13986fd4f8a029f744e9dad0 commit ccd9426e7127373c13986fd4f8a029f744e9dad0 Author: Lei Zhang <thestig@chromium.org> Date: Fri Apr 27 20:52:58 2018 Adjust CJBig2_Context::HuffmanAssignCode(). It looks a lot like CJBig2_HuffmanTable::InitCodes(). Port over the UBSAN error fix from commit 76c9a1b1. BUG= chromium:709781 Change-Id: I5d2f8fb013c09099c82b0565627b77e4fb0f8a98 Reviewed-on: https://pdfium-review.googlesource.com/31536 Commit-Queue: Lei Zhang <thestig@chromium.org> Reviewed-by: Henrique Nakashima <hnakashima@chromium.org> [modify] https://crrev.com/ccd9426e7127373c13986fd4f8a029f744e9dad0/core/fxcodec/jbig2/JBig2_Context.h [modify] https://crrev.com/ccd9426e7127373c13986fd4f8a029f744e9dad0/core/fxcodec/jbig2/JBig2_HuffmanTable.cpp [modify] https://crrev.com/ccd9426e7127373c13986fd4f8a029f744e9dad0/core/fxcodec/jbig2/JBig2_Context.cpp
,
Apr 27 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/a49f5c8b664b17643020fb17acf79052e743099b commit a49f5c8b664b17643020fb17acf79052e743099b Author: pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Date: Fri Apr 27 23:32:10 2018 Roll src/third_party/pdfium/ 3241bb3e9..65c255ad2 (18 commits) https://pdfium.googlesource.com/pdfium.git/+log/3241bb3e98c0..65c255ad2076 $ git log 3241bb3e9..65c255ad2 --date=short --no-merges --format='%ad %ae %s' 2018-04-27 tsepez Fix illegal cast in core/fxge/win32/fx_win32_gdipext.cpp 2018-04-27 thestig Remove CJBig2_HuffmanTable::InitCodes(). 2018-04-27 tsepez Replace void* with CFX_GifPalette* in fxcodec 2018-04-27 hnakashima Fix focused day disappears in XFA MonthCalendar. 2018-04-27 hnakashima Update caret after changes that could move lines in XFA edit. 2018-04-27 thestig Change CJBig2_HuffmanTable to use struct JBig2HuffmanCode. 2018-04-27 thestig Adjust CJBig2_Context::HuffmanAssignCode(). 2018-04-27 tsepez Remove arguments from CPDFSDK_FormFillEnvironment methods (part 2) 2018-04-27 thestig Simplify CJBig2_Context::DecodeSymbolIDHuffmanTable(). 2018-04-27 thestig Use std::function in CJBig2_GRDProc. 2018-04-27 hnakashima Fix backspace on 1st character of a line erases the line break. 2018-04-27 thestig Disambiguate methods in CJBig2_GRDProc. 2018-04-27 thestig Simplify CJBig2_Context::FindReferredSegmentByTypeAndIndex(). 2018-04-27 tsepez Avoid potential duplicate unique_ptr to CPDF_Document from CPDFXA_Context. 2018-04-27 tsepez Remove argument from CPDFSDK_FormFillEnvironment::GetCurrentPage 2018-04-27 thestig Add DEPS include_rules for xfa/fwl. 2018-04-27 thestig Fix undefined behavior in AGG. 2018-04-27 thestig Do validation earlier in CPDF_SampledFunc::v_Init(). (try 2) Created with: roll-dep src/third_party/pdfium BUG= chromium:836361 , chromium:709781 , chromium:836361 ,chromium:746232 The AutoRoll server is located here: https://pdfium-roll.skia.org Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. TBR=dsinclair@chromium.org Change-Id: I3f93d2671a6cc6f854854c61eea6104ae84cc21e Reviewed-on: https://chromium-review.googlesource.com/1033831 Commit-Queue: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Reviewed-by: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#554557} [modify] https://crrev.com/a49f5c8b664b17643020fb17acf79052e743099b/DEPS |
||
►
Sign in to add a comment |
||
Comment 1 by msrchandra@chromium.org
, Apr 10 2017Components: Internals>Plugins>PDF
Labels: Test-Predator-Correct-CLs M-58
Owner: dsinclair@chromium.org
Status: Assigned (was: Untriaged)