New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 709781 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Apr 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Undefined-shift in CJBig2_HuffmanTable::InitCodes

Project Member Reported by ClusterFuzz, Apr 9 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6656313099812864

Fuzzer: libfuzzer_pdf_codec_jbig2_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  CJBig2_HuffmanTable::InitCodes
  CJBig2_HuffmanTable::ParseFromCodedBuffer
  CJBig2_HuffmanTable::CJBig2_HuffmanTable
  
Sanitizer: undefined (UBSAN)

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv96ZloAOOvUJPqUh7Ht4YK807i_jBJwUWXkIP_JW3WpDYCyZUmnIYb7wN79WSMKHwu5g392duuJF5G7KxD-1T-rp4IoKbEASYKGK8ccCm_YwodpfydSWpnj_ZeMEW8dW6onOn2rZXvlSxiLDFXo38VTWLHQGqke6h3-Bdp9vTArnfFWtBqqES7RUvmDSx7GcigedVxMs1H4aU40v0WeIqC_E-2jwyFKhGJCu9I7uQTKjFqSK30h3afxSt0DqOgGmQgze5fQVWaoKQQLauqLyab51X3QMZkssKBEuB5-STbaWSY3eyW5M-WFuQKjBfIvoNkxOE4wUjeq_I-xNE4Nd-rtLNKD2lWiBs9duVySjMbqWSWGUGfQ?testcase_id=6656313099812864


Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org
Components: Internals>Plugins>PDF
Labels: Test-Predator-Correct-CLs M-58
Owner: dsinclair@chromium.org
Status: Assigned (was: Untriaged)
Assigning to the concern owner from Predator results --
Regression information is not available. The result is the blame information. 

Author: Dan Sinclair
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/764ec513eecbebd12781bcc96ce81ed5e736ee92
Time: Mon Mar 14 13:35:12 2016 -0400
The CL last changed line 118 of file JBig2_HuffmanTable.cpp, which is stack frame 0. 

Author: Dan Sinclair
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/764ec513eecbebd12781bcc96ce81ed5e736ee92
Time: Mon Mar 14 13:35:12 2016 -0400
The CL last changed line 100 of file JBig2_HuffmanTable.cpp, which is stack frame 1. 

Author: Dan Sinclair
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/764ec513eecbebd12781bcc96ce81ed5e736ee92
Time: Mon Mar 14 13:35:12 2016 -0400
The CL last changed line 27 of file JBig2_HuffmanTable.cpp, which is stack frame 2. 

Author: tsepez
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/36eb4bdcae719cf33c536ff72ac000482aed8382
Time: Mon Oct 03 15:24:27 2016 -0700
The CL last changed line 56 of file ptr_util.h, which is stack frame 3. 

Author: Dan Sinclair
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/0bb1333a9eff1190ddd68f34c71d6a779c69dfef
Time: Thu Mar 30 16:12:02 2017 -0400
The CL last changed line 1233 of file JBig2_Context.cpp, which is stack frame 4. 

Author: Dan Sinclair
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/764ec513eecbebd12781bcc96ce81ed5e736ee92
Time: Mon Mar 14 13:35:12 2016 -0400
The CL last changed line 330 of file JBig2_Context.cpp, which is stack frame 5. 

Author: Dan Sinclair
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/764ec513eecbebd12781bcc96ce81ed5e736ee92
Time: Mon Mar 14 13:35:12 2016 -0400
The CL last changed line 88 of file JBig2_Context.cpp, which is stack frame 6.

@dsinclair -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Status: Started (was: Assigned)
https://pdfium-review.googlesource.com/c/3990/
Status: Fixed (was: Started)
Project Member

Comment 4 by ClusterFuzz, Apr 12 2017

ClusterFuzz has detected this issue as fixed in range 463671:463725.

Detailed report: https://clusterfuzz.com/testcase?key=6656313099812864

Fuzzer: libfuzzer_pdf_codec_jbig2_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  CJBig2_HuffmanTable::InitCodes
  CJBig2_HuffmanTable::ParseFromCodedBuffer
  CJBig2_HuffmanTable::CJBig2_HuffmanTable
  
Sanitizer: undefined (UBSAN)

Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=463671:463725

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv96ZloAOOvUJPqUh7Ht4YK807i_jBJwUWXkIP_JW3WpDYCyZUmnIYb7wN79WSMKHwu5g392duuJF5G7KxD-1T-rp4IoKbEASYKGK8ccCm_YwodpfydSWpnj_ZeMEW8dW6onOn2rZXvlSxiLDFXo38VTWLHQGqke6h3-Bdp9vTArnfFWtBqqES7RUvmDSx7GcigedVxMs1H4aU40v0WeIqC_E-2jwyFKhGJCu9I7uQTKjFqSK30h3afxSt0DqOgGmQgze5fQVWaoKQQLauqLyab51X3QMZkssKBEuB5-STbaWSY3eyW5M-WFuQKjBfIvoNkxOE4wUjeq_I-xNE4Nd-rtLNKD2lWiBs9duVySjMbqWSWGUGfQ?testcase_id=6656313099812864


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by bugdroid1@chromium.org, Apr 27 2018

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/ccd9426e7127373c13986fd4f8a029f744e9dad0

commit ccd9426e7127373c13986fd4f8a029f744e9dad0
Author: Lei Zhang <thestig@chromium.org>
Date: Fri Apr 27 20:52:58 2018

Adjust CJBig2_Context::HuffmanAssignCode().

It looks a lot like CJBig2_HuffmanTable::InitCodes(). Port over the
UBSAN error fix from commit 76c9a1b1.

BUG= chromium:709781 

Change-Id: I5d2f8fb013c09099c82b0565627b77e4fb0f8a98
Reviewed-on: https://pdfium-review.googlesource.com/31536
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>

[modify] https://crrev.com/ccd9426e7127373c13986fd4f8a029f744e9dad0/core/fxcodec/jbig2/JBig2_Context.h
[modify] https://crrev.com/ccd9426e7127373c13986fd4f8a029f744e9dad0/core/fxcodec/jbig2/JBig2_HuffmanTable.cpp
[modify] https://crrev.com/ccd9426e7127373c13986fd4f8a029f744e9dad0/core/fxcodec/jbig2/JBig2_Context.cpp

Project Member

Comment 6 by bugdroid1@chromium.org, Apr 27 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a49f5c8b664b17643020fb17acf79052e743099b

commit a49f5c8b664b17643020fb17acf79052e743099b
Author: pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Fri Apr 27 23:32:10 2018

Roll src/third_party/pdfium/ 3241bb3e9..65c255ad2 (18 commits)

https://pdfium.googlesource.com/pdfium.git/+log/3241bb3e98c0..65c255ad2076

$ git log 3241bb3e9..65c255ad2 --date=short --no-merges --format='%ad %ae %s'
2018-04-27 tsepez Fix illegal cast in core/fxge/win32/fx_win32_gdipext.cpp
2018-04-27 thestig Remove CJBig2_HuffmanTable::InitCodes().
2018-04-27 tsepez Replace void* with CFX_GifPalette* in fxcodec
2018-04-27 hnakashima Fix focused day disappears in XFA MonthCalendar.
2018-04-27 hnakashima Update caret after changes that could move lines in XFA edit.
2018-04-27 thestig Change CJBig2_HuffmanTable to use struct JBig2HuffmanCode.
2018-04-27 thestig Adjust CJBig2_Context::HuffmanAssignCode().
2018-04-27 tsepez Remove arguments from CPDFSDK_FormFillEnvironment methods (part 2)
2018-04-27 thestig Simplify CJBig2_Context::DecodeSymbolIDHuffmanTable().
2018-04-27 thestig Use std::function in CJBig2_GRDProc.
2018-04-27 hnakashima Fix backspace on 1st character of a line erases the line break.
2018-04-27 thestig Disambiguate methods in CJBig2_GRDProc.
2018-04-27 thestig Simplify CJBig2_Context::FindReferredSegmentByTypeAndIndex().
2018-04-27 tsepez Avoid potential duplicate unique_ptr to CPDF_Document from CPDFXA_Context.
2018-04-27 tsepez Remove argument from CPDFSDK_FormFillEnvironment::GetCurrentPage
2018-04-27 thestig Add DEPS include_rules for xfa/fwl.
2018-04-27 thestig Fix undefined behavior in AGG.
2018-04-27 thestig Do validation earlier in CPDF_SampledFunc::v_Init(). (try 2)

Created with:
  roll-dep src/third_party/pdfium
BUG= chromium:836361 , chromium:709781 , chromium:836361 ,chromium:746232


The AutoRoll server is located here: https://pdfium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


TBR=dsinclair@chromium.org

Change-Id: I3f93d2671a6cc6f854854c61eea6104ae84cc21e
Reviewed-on: https://chromium-review.googlesource.com/1033831
Commit-Queue: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Reviewed-by: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#554557}
[modify] https://crrev.com/a49f5c8b664b17643020fb17acf79052e743099b/DEPS

Sign in to add a comment