Issue metadata
Sign in to add a comment
|
Global-buffer-overflow in GuessSizeForVSWPrintf |
||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5220497502765056 Fuzzer: libFuzzer_pdfium_xfa_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Global-buffer-overflow READ 16 Crash Address: 0x0000033ca8cc Crash State: GuessSizeForVSWPrintf CFX_WideString::FormatV CXFA_FM2JSContext::ThrowException Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=460713:460958 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5220497502765056 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Jun 13 2017
,
Jun 13 2017
,
Jun 13 2017
,
Jun 13 2017
Adjusting labels because XFA. I thought https://pdfium-review.googlesource.com/5331 would have fixed these. Always more...
,
Jun 13 2017
,
Jun 14 2017
The following revision refers to this bug: https://pdfium.googlesource.com/pdfium/+/0698c856aaa3e54574f306c35397d6b792a95a3e commit 0698c856aaa3e54574f306c35397d6b792a95a3e Author: Lei Zhang <thestig@chromium.org> Date: Wed Jun 14 13:17:52 2017 Fix bad format string in CXFA_FM2JSContext. PDFium's vswprintf() is based on the win32 version to be consistent across platforms. On Windows, %s has different meanings depending on whether the printf() variant is wide or not. BUG= chromium:732533 Change-Id: I7437ecd253da1234728c1e0897f02b7f907aada8 Reviewed-on: https://pdfium-review.googlesource.com/6550 Commit-Queue: dsinclair <dsinclair@chromium.org> Reviewed-by: dsinclair <dsinclair@chromium.org> [modify] https://crrev.com/0698c856aaa3e54574f306c35397d6b792a95a3e/xfa/fxfa/fm2js/cxfa_fm2jscontext.cpp
,
Jun 14 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/45576f3a4a01bf8095a8934f8851983a93e31825 commit 45576f3a4a01bf8095a8934f8851983a93e31825 Author: pdfium-deps-roller@chromium.org <pdfium-deps-roller@chromium.org> Date: Wed Jun 14 17:19:20 2017 Roll src/third_party/pdfium/ 957480c17..f0f2a2a52 (4 commits) https://pdfium.googlesource.com/pdfium.git/+log/957480c17682..f0f2a2a528e1 $ git log 957480c17..f0f2a2a52 --date=short --no-merges --format='%ad %ae %s' 2017-06-13 thestig Fix a buffer overflow in FPDFPage_Flatten(). 2017-06-13 thestig Fix some nits in CFFL_InteractiveFormFiller. 2017-06-13 thestig Remove deprecated FPDPage_HasFormFieldAtPoint(). 2017-06-13 thestig Fix bad format string in CXFA_FM2JSContext. Created with: roll-dep src/third_party/pdfium BUG=732661, 732533 Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, see: http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls TBR=dsinclair@chromium.org Change-Id: I7e46b976b0bf8b8de2df9e9f77d5ba2957698833 Reviewed-on: https://chromium-review.googlesource.com/534941 Reviewed-by: <pdfium-deps-roller@chromium.org> Commit-Queue: <pdfium-deps-roller@chromium.org> Cr-Commit-Position: refs/heads/master@{#479430} [modify] https://crrev.com/45576f3a4a01bf8095a8934f8851983a93e31825/DEPS
,
Jun 15 2017
ClusterFuzz has detected this issue as fixed in range 479371:479434. Detailed report: https://clusterfuzz.com/testcase?key=5220497502765056 Fuzzer: libFuzzer_pdfium_xfa_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Global-buffer-overflow READ 16 Crash Address: 0x0000033ca8cc Crash State: GuessSizeForVSWPrintf CFX_WideString::FormatV CXFA_FM2JSContext::ThrowException Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=460713:460958 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=479371:479434 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5220497502765056 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jun 15 2017
ClusterFuzz testcase 5220497502765056 is verified as fixed, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Jun 15 2017
,
Sep 21 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by sheriffbot@chromium.org
, Jun 13 2017