New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 718500 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: May 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac
Pri: 2
Type: Bug



Sign in to add a comment

Direct-leak in _cmsMallocZero

Project Member Reported by ClusterFuzz, May 4 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5681383547863040

Fuzzer: libfuzzer_pdf_codec_icc_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  _cmsMallocZero
  cmsPipelineAlloc
  Type_MPE_Read
  
Sanitizer: address (ASAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5681383547863040


Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: bo...@foxitsoftware.com msrchandra@chromium.org
Components: Internals>Plugins>PDF
Labels: M-59 Test-Predator-Correct-CLs
Owner: palmer@chromium.org
Status: Assigned (was: Untriaged)
Below is the Predator information --
Regression information is not available. The result is the blame information. 

Author: Bo Xu
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/3522876d5291922ddc62bf1b70d02743b0850673
Time: Tue Jul 08 15:30:46 2014 -0700
The CL last changed line 271 of file cmserr.c, which is stack frame 1. 

Author: John Abd-El-Malek
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/5110c4743751145c4ae1934cd1d83bc6c55bb43f
Time: Sat May 17 22:33:34 2014 -0700
The CL last changed line 1356 of file cmslut.c, which is stack frame 2. 

Author: John Abd-El-Malek
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/5110c4743751145c4ae1934cd1d83bc6c55bb43f
Time: Sat May 17 22:33:34 2014 -0700
The CL last changed line 4460 of file cmstypes.c, which is stack frame 3. 

Author: John Abd-El-Malek
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/5110c4743751145c4ae1934cd1d83bc6c55bb43f
Time: Sat May 17 22:33:34 2014 -0700
The CL last changed line 1535 of file cmsio0.c, which is stack frame 4. 

Author: John Abd-El-Malek
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/5110c4743751145c4ae1934cd1d83bc6c55bb43f
Time: Sat May 17 22:33:34 2014 -0700
The CL last changed line 273 of file cmsio1.c, which is stack frame 5. 

Author: John Abd-El-Malek
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/5110c4743751145c4ae1934cd1d83bc6c55bb43f
Time: Sat May 17 22:33:34 2014 -0700
The CL last changed line 608 of file cmscnvrt.c, which is stack frame 6. 

Author: John Abd-El-Malek
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/5110c4743751145c4ae1934cd1d83bc6c55bb43f
Time: Sat May 17 22:33:34 2014 -0700
The CL last changed line 856 of file cmsxform.c, which is stack frame 7.

Suspecting Commit#
https://pdfium.googlesource.com/pdfium.git/+/3522876d5291922ddc62bf1b70d02743b0850673

@palmer -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Cc: -bo...@foxitsoftware.com
Cc: dsinclair@chromium.org tsepez@chromium.org
Labels: OS-Android OS-Chrome OS-Mac OS-Windows
Owner: ----
Status: Available (was: Assigned)
I don't think this is related to any work of mine.

It's also probably not Linux-specific?
Owner: npm@chromium.org
Status: Assigned (was: Available)
npm@ can you take a look?
Project Member

Comment 6 by ClusterFuzz, May 9 2017

ClusterFuzz has detected this issue as fixed in range 470151:470238.

Detailed report: https://clusterfuzz.com/testcase?key=5681383547863040

Fuzzer: libfuzzer_pdf_codec_icc_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  _cmsMallocZero
  cmsPipelineAlloc
  Type_MPE_Read
  
Sanitizer: address (ASAN)

Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=470151:470238

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5681383547863040


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, May 9 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5681383547863040 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment