New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 718731 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Sep 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Undefined-shift in opj_pi_next_cprl

Project Member Reported by ClusterFuzz, May 5 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6608457607413760

Fuzzer: libfuzzer_pdf_jpx_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  opj_pi_next_cprl
  opj_t2_decode_packets
  opj_tcd_t2_decode
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=469455:469504

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6608457607413760


Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org sandeepkumars@chromium.org
Labels: M-62 Test-Predator-Wrong-CLs
Owner: npm@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using Code Search for the file, "libopenjpeg20/pi.c" assigning to the concern owner who might be related.

Suspecting Commit#
https://pdfium.googlesource.com/pdfium.git/+/9818dc150132ac04148174258423e394eb0948b9

@npm -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Comment 2 by npm@chromium.org, Aug 30 2017

Components: Internals>Plugins>PDF
Project Member

Comment 3 by bugdroid1@chromium.org, Sep 5 2017

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c

commit 088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c
Author: Nicolas Pena <npm@chromium.org>
Date: Tue Sep 05 14:10:37 2017

Upgrade OpenJPEG to 2.2.0

This CL upgrades OpenJPEG by copying the files from 2.2.0 and then applying
patches. Patch files that are no longer relevant are deleted. The relevant
ones are applied manually due to changes in formatting in OpenJPEG. Patch 34
is added to account for opj_malloc changes in PDFium.

Bug:  chromium:718731 
Change-Id: I3d316893eab5e235c9f71222a6818b8ae0c98383
Reviewed-on: https://pdfium-review.googlesource.com/12770
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>

[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/0005-jp2_apply_pclr.patch
[delete] https://crrev.com/740bcd892d22136873b2b123b94e51bf6e77b8f9/third_party/libopenjpeg20/0021-tcd_init_tile_negative.patch
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/indexbox_manager.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/0014-opj_jp2_read_ihdr_leak.patch
[delete] https://crrev.com/740bcd892d22136873b2b123b94e51bf6e77b8f9/third_party/libopenjpeg20/0030-undefined-shift-opj_get_all_encoding_parameters.patch
[delete] https://crrev.com/740bcd892d22136873b2b123b94e51bf6e77b8f9/third_party/libopenjpeg20/0008-jp2_check_color.patch
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/0023-opj_j2k_read_mct_records.patch
[delete] https://crrev.com/740bcd892d22136873b2b123b94e51bf6e77b8f9/third_party/libopenjpeg20/0017-tcd_init_tile.patch
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/t1_luts.h
[add] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/mqc_inl.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/0025-opj_j2k_add_mct_null_data.patch
[delete] https://crrev.com/740bcd892d22136873b2b123b94e51bf6e77b8f9/third_party/libopenjpeg20/0029-avoid-division-by-0.patch
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/README.pdfium
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/opj_inttypes.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/opj_clock.c
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/opj_config_private.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/opj_clock.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/openjpeg.c
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/0006-tcd_init_tile.patch
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/pi.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/openjpeg.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/event.c
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/event.h
[delete] https://crrev.com/740bcd892d22136873b2b123b94e51bf6e77b8f9/third_party/libopenjpeg20/0031-undefined-shift-opj_bio_read.patch
[delete] https://crrev.com/740bcd892d22136873b2b123b94e51bf6e77b8f9/third_party/libopenjpeg20/raw.c
[delete] https://crrev.com/740bcd892d22136873b2b123b94e51bf6e77b8f9/third_party/libopenjpeg20/0001-image-data.patch
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/image.c
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/0012-mct_sse.patch
[delete] https://crrev.com/740bcd892d22136873b2b123b94e51bf6e77b8f9/third_party/libopenjpeg20/0028-upstream-check-size-in-opj_j2k_read_siz.patch
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/0000-use-colorspace.patch
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/image.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/opj_stdint.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/tcd.c
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/t2.c
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/t1.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/t2.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/t1.c
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/opj_config.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/BUILD.gn
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/opj_intmath.h
[delete] https://crrev.com/740bcd892d22136873b2b123b94e51bf6e77b8f9/third_party/libopenjpeg20/0010-pi_update_decode_poc.patch
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/0019-tcd_init_tile.patch
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/0022-jp2_apply_pclr_overflow.patch
[delete] https://crrev.com/740bcd892d22136873b2b123b94e51bf6e77b8f9/third_party/libopenjpeg20/0032-undefined-shift-opj_j2k_read_siz.patch
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/mqc.c
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/pi.c
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/jp2.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/mqc.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/jp2.c
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/cio.c
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/0003-dwt-decode.patch
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/cio.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/0015-read_SPCod_SPCoc_overflow.patch
[add] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/0034-opj_malloc.patch
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/function_list.c
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/bio.c
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/function_list.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/bio.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/0026-use_opj_uint_ceildiv.patch
[add] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/thread.h
[add] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/thread.c
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/opj_includes.h
[delete] https://crrev.com/740bcd892d22136873b2b123b94e51bf6e77b8f9/third_party/libopenjpeg20/0018-tcd_get_decoded_tile_size.patch
[delete] https://crrev.com/740bcd892d22136873b2b123b94e51bf6e77b8f9/third_party/libopenjpeg20/0024-l_marker_size_check.patch
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/0011-j2k_update_image_data.patch
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/0007-jp2_read_cmap.patch
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/mct.h
[delete] https://crrev.com/740bcd892d22136873b2b123b94e51bf6e77b8f9/third_party/libopenjpeg20/0013-attrib_fix.patch
[delete] https://crrev.com/740bcd892d22136873b2b123b94e51bf6e77b8f9/third_party/libopenjpeg20/0004-j2k_read_mcc.patch
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/mct.c
[delete] https://crrev.com/740bcd892d22136873b2b123b94e51bf6e77b8f9/third_party/libopenjpeg20/0027-undefined-shift-opj_t1_decode_cblk.patch
[add] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/tls_keys.h
[delete] https://crrev.com/740bcd892d22136873b2b123b94e51bf6e77b8f9/third_party/libopenjpeg20/0020-opj_aligned_malloc.patch
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/opj_malloc.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/j2k.h
[delete] https://crrev.com/740bcd892d22136873b2b123b94e51bf6e77b8f9/third_party/libopenjpeg20/0002-packet-iterator.patch
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/0009-opj_pi_next.patch
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/tcd.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/j2k.c
[delete] https://crrev.com/740bcd892d22136873b2b123b94e51bf6e77b8f9/third_party/libopenjpeg20/raw.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/tgt.c
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/invert.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/invert.c
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/tgt.h
[add] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/opj_common.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/opj_codec.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/dwt.c
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/t1_generate_luts.c
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/dwt.h
[modify] https://crrev.com/088ca03f25fe1f6d75c0ff3b71e0ad3d018a5e0c/third_party/libopenjpeg20/0016-read_SQcd_SQcc_overflow.patch

Project Member

Comment 4 by ClusterFuzz, Sep 6 2017

ClusterFuzz has detected this issue as fixed in range 499756:499820.

Detailed report: https://clusterfuzz.com/testcase?key=6608457607413760

Fuzzer: libFuzzer_pdf_jpx_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  opj_pi_next_cprl
  opj_t2_decode_packets
  opj_tcd_t2_decode
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=469455:469504
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=499756:499820

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6608457607413760

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Sep 6 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6608457607413760 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment