Null-dereference WRITE in safe_browsing::dmg::UDIFBlockChunkReadStream::HandleZLib |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6217737461563392 Fuzzer: libFuzzer_safe_browsing_dmg_fuzzer Job Type: mac_libfuzzer_chrome_asan Platform Id: mac Crash Type: Null-dereference WRITE Crash Address: 0x000000000000 Crash State: safe_browsing::dmg::UDIFBlockChunkReadStream::HandleZLib safe_browsing::dmg::UDIFPartitionReadStream::Read safe_browsing::dmg::ReadStream::ReadExact Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=423384:423408 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6217737461563392 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Jul 7 2017
,
Jul 7 2017
,
Jul 7 2017
The top of the stack isn't shown, but it indicates a simple failure to allocate. Probably not interesting and this would just hard crash in production due to OOM being fatal. #0 0x10efc7f8b in construct<unsigned char, const unsigned char &> third_party/llvm-build/Release+Asserts/include/c++/v1/memory:1798:13 #1 0x10efc7f8b in __construct<unsigned char, const unsigned char &> third_party/llvm-build/Release+Asserts/include/c++/v1/memory:1709 #2 0x10efc7f8b in construct<unsigned char, const unsigned char &> third_party/llvm-build/Release+Asserts/include/c++/v1/memory:1555 #3 0x10efc7f8b in __construct_at_end third_party/llvm-build/Release+Asserts/include/c++/v1/vector:1006 #4 0x10efc7f8b in std::__1::vector<unsigned char, std::__1::allocator<unsigned char> >::vector(unsigned long, unsigned char const&) third_party/llvm-build/Release+Asserts/include/c++/v1/vector:1104 #5 0x10efe01e5 in safe_browsing::dmg::(anonymous namespace)::UDIFBlockChunkReadStream::HandleZLib(unsigned char*, unsigned long, unsigned long*) chrome/utility/safe_browsing/mac/udif.cc:792:26
,
Jul 14 2017
ClusterFuzz has detected this issue as fixed in range 485997:486042. Detailed report: https://clusterfuzz.com/testcase?key=6217737461563392 Fuzzer: libFuzzer_safe_browsing_dmg_fuzzer Job Type: mac_libfuzzer_chrome_asan Platform Id: mac Crash Type: Null-dereference WRITE Crash Address: 0x000000000000 Crash State: safe_browsing::dmg::UDIFBlockChunkReadStream::HandleZLib safe_browsing::dmg::UDIFPartitionReadStream::Read safe_browsing::dmg::ReadStream::ReadExact Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=423384:423408 Fixed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=485997:486042 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6217737461563392 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jul 14 2017
ClusterFuzz testcase 6217737461563392 is verified as fixed, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Jul 14 2017
ClusterFuzz has detected this issue as fixed in range 485997:486042. Detailed report: https://clusterfuzz.com/testcase?key=6217737461563392 Fuzzer: libFuzzer_safe_browsing_dmg_fuzzer Job Type: mac_libfuzzer_chrome_asan Platform Id: mac Crash Type: Null-dereference WRITE Crash Address: 0x000000000000 Crash State: safe_browsing::dmg::UDIFBlockChunkReadStream::HandleZLib safe_browsing::dmg::UDIFPartitionReadStream::Read safe_browsing::dmg::ReadStream::ReadExact Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=423384:423408 Fixed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=485997:486042 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6217737461563392 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
||||
►
Sign in to add a comment |
||||
Comment 1 by shrike@chromium.org
, Jul 6 2017