New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 727704 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Closed: Feb 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 1
Type: Bug



Sign in to add a comment

Out-of-memory in sqlite3_ossfuzz_fuzzer

Project Member Reported by ClusterFuzz, May 30 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5592386070904832

Fuzzer: libfuzzer_sqlite3_ossfuzz_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Out-of-memory (exceeds 2048 MB)
Crash Address: 
Crash State:
  sqlite3_ossfuzz_fuzzer
  
Sanitizer: address (ASAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5592386070904832


Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, May 30 2017

Labels: OS-Mac
Cc: msrchandra@chromium.org
Labels: Test-Predator-Correct
Owner: mmoroz@chromium.org
Status: Assigned (was: Untriaged)
Assigning to the concern owner from Predator results --
Regression information is not available. The result is the blame information. 

Author: Scott Hess
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/dcf12048055030a2b5858ceca5ce26294a82a6e4
Time: Tue Feb 10 21:33:29 2015
The CL last changed line 20810 of file sqlite3.c, which is stack frame 1. 

Author: shess@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/fdd072ff1b52f405ed3c2b1cfb86c6e92e5018c1
Time: Wed Apr 13 20:47:24 2011
The CL last changed line 24716 of file sqlite3.c, which is stack frame 2. 

Author: shess@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/fdd072ff1b52f405ed3c2b1cfb86c6e92e5018c1
Time: Wed Apr 13 20:47:24 2011
The CL last changed line 24748 of file sqlite3.c, which is stack frame 3. 

Author: Scott Hess
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/dcf12048055030a2b5858ceca5ce26294a82a6e4
Time: Tue Feb 10 21:33:29 2015
The CL last changed line 24882 of file sqlite3.c, which is stack frame 4. 

Author: Scott Hess
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/0270407c0555655d204235d1fa39c86d453cb809
Time: Mon Mar 20 19:38:21 2017
The CL last changed line 24865 of file sqlite3.c, which is stack frame 5. 

Author: shess@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/fdd072ff1b52f405ed3c2b1cfb86c6e92e5018c1
Time: Wed Apr 13 20:47:24 2011
The CL last changed line 24899 of file sqlite3.c, which is stack frame 6. 

Author: shess@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/fdd072ff1b52f405ed3c2b1cfb86c6e92e5018c1
Time: Wed Apr 13 20:47:24 2011
The CL last changed line 69714 of file sqlite3.c, which is stack frame 7.

Assigning to the owner who might be related to similar kind of fuzzer.

@mmoroz -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Project Member

Comment 3 by ClusterFuzz, Jun 15 2017

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://cluster-fuzz.appspot.com/testcase?key=5978575806398464

Comment 4 by mmoroz@chromium.org, Jun 15 2017

Cc: pwnall@chromium.org
Owner: michaeln@chromium.org
It is reproducible with release ASan build: https://clusterfuzz.com/v2/testcase-detail/5978575806398464?noredirect=1

But seems to work fine on OSS-Fuzz (it uses ToT sqlite revision):
	Running command: /mnt/scratch0/clusterfuzz/slave-bot/builds/clusterfuzz-builds_sqlite3_fffb9177be4c0ebe1f593027cd55207167f96a43/revisions/ossfuzz -rss_limit_mb=2048 -timeout=25 -runs=100 /clusterfuzz-testcase-5592386070904832
INFO: Seed: 1045920962
INFO: Loaded 1 modules (21257 guards): [0xb918b0, 0xba64d4),
/mnt/scratch0/clusterfuzz/slave-bot/builds/clusterfuzz-builds_sqlite3_fffb9177be4c0ebe1f593027cd55207167f96a43/revisions/ossfuzz: Running 1 inputs 100 time(s) each.
Running: /clusterfuzz-testcase-5592386070904832
#64	pulse  cov: 2372 ft: 2406 exec/s: 32 rss: 69Mb
Executed /clusterfuzz-testcase-5592386070904832 in 3212 ms
***
*** NOTE: fuzzing was not performed, you have only
***       executed the target code on a fixed set of inputs.




Project Member

Comment 5 by ClusterFuzz, Jun 16 2017

Detailed report: https://clusterfuzz.com/testcase?key=5978575806398464

Fuzzer: sqlite3_ossfuzz_fuzzer
Job Type: libfuzzer_chrome_asan
Crash Type: Timeout (exceeds 25 secs)
Crash Address: 
Crash State:
  sqlite3_ossfuzz_fuzzer
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=434473:434491

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5978575806398464


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
Project Member

Comment 6 by ClusterFuzz, Oct 1 2017

Components: Blink>Storage
Labels: Test-Predator-AutoComponents
Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.

Comment 7 by mmoroz@chromium.org, Oct 24 2017

For more information, please see https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md.

The link referenced in the description is no longer valid.

(bulk edit)

Comment 8 by costan@google.com, Oct 24 2017

Cc: -pwnall@chromium.org michaeln@chromium.org
Owner: pwnall@chromium.org
I am the primary owner of SQLite. Fortunately, the test case link still works.
Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components
Components: -Blink>Storage Internals>Storage
Project Member

Comment 11 by ClusterFuzz, Feb 22 2018

Status: WontFix (was: Assigned)
ClusterFuzz testcase 5978575806398464 is flaky and no longer crashes, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment