Out-of-memory in pdf_jpx_fuzzer |
||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5324028922560512 Fuzzer: libFuzzer_pdf_jpx_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Out-of-memory (exceeds 2048 MB) Crash Address: Crash State: pdf_jpx_fuzzer Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=395640:395746 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5324028922560512 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Jul 3 2017
Predator and CL did not provide any possible suspects. Using Code Search for the file, "pdf_jpx_fuzzer" assigning to the concern owner. Suspecting Commit# https://pdfium.googlesource.com/pdfium.git/+/37cc5fb6b3407ce8e079bc1bdd0606713b975532 @npm -- Could you please look into the issue, kindly re-assign if this is not related to your changes. Thank You.
,
Jul 4 2017
,
Jul 5 2017
,
Jul 12 2017
Large tile sizes are allocated in opj_tcd_init_tile. The allocated data is used in different ways in multiple places, so fixing this would probably require a large refactoring of this third party library. Marking as WontFix
,
Jul 19 2017
ClusterFuzz testcase 5324028922560512 is still reproducing on tip-of-tree build (trunk). If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase. Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace.
,
Jul 19 2017
Clusterfuzz wants us to look again ...
,
Jul 28 2017
Is there any way to reject such inputs in the fuzz target (https://cs.chromium.org/chromium/src/third_party/pdfium/testing/libfuzzer/pdf_jpx_fuzzer.cc)? If I understood correctly, OOM is a kind of intended behavior here. If so, it would be fine to simply do "return 0;" for inputs with too large tile size. If course, if that's easy to check the size :) This bug is a blocker for gaining new code coverage and doing efficient continuous testing, as it occurs in 84% of fuzzer runs: https://clusterfuzz.com/v2/performance-report/libFuzzer_pdf_jpx_fuzzer/libfuzzer_chrome_asan/latest
,
Aug 23 2017
https://pdfium-review.googlesource.com/c/pdfium/+/11870
,
Aug 28 2017
The following revision refers to this bug: https://pdfium.googlesource.com/pdfium/+/b0860beccd6a4a8d9f8ea3dbba392a3a13218ad3 commit b0860beccd6a4a8d9f8ea3dbba392a3a13218ad3 Author: Lei Zhang <thestig@chromium.org> Date: Mon Aug 28 16:16:38 2017 Limit pdf_jpx_fuzzer memory usage. BUG= chromium:738711 Change-Id: I4a308694c3e6fcd17431515b7897969d54486071 Reviewed-on: https://pdfium-review.googlesource.com/11870 Commit-Queue: dsinclair <dsinclair@chromium.org> Reviewed-by: Henrique Nakashima <hnakashima@chromium.org> Reviewed-by: dsinclair <dsinclair@chromium.org> [modify] https://crrev.com/b0860beccd6a4a8d9f8ea3dbba392a3a13218ad3/testing/libfuzzer/pdf_jpx_fuzzer.cc
,
Aug 28 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/2f439e8d6a1946b4dc4f4d263a0ef7e9bfd4bf61 commit 2f439e8d6a1946b4dc4f4d263a0ef7e9bfd4bf61 Author: pdfium-deps-roller@chromium.org <pdfium-deps-roller@chromium.org> Date: Mon Aug 28 17:52:04 2017 Roll src/third_party/pdfium/ 133617c2d..b0860becc (4 commits) https://pdfium.googlesource.com/pdfium.git/+log/133617c2d2b9..b0860beccd6a $ git log 133617c2d..b0860becc --date=short --no-merges --format='%ad %ae %s' 2017-08-23 thestig Limit pdf_jpx_fuzzer memory usage. 2017-08-23 thestig Skip decoding of excessively large JBIG2 images. 2017-08-28 art-snake Unify CPDF_SyntaxParser::GetObjectXXX methods. 2017-08-28 dsinclair Add a global font loader in XFA tests Created with: roll-dep src/third_party/pdfium BUG= 738711 ,749610. Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, see: http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls TBR=dsinclair@chromium.org Change-Id: I9992d6f4f1ba5239be43366f3eab8eba9ee1cff2 Reviewed-on: https://chromium-review.googlesource.com/638610 Reviewed-by: <pdfium-deps-roller@chromium.org> Commit-Queue: <pdfium-deps-roller@chromium.org> Cr-Commit-Position: refs/heads/master@{#497795} [modify] https://crrev.com/2f439e8d6a1946b4dc4f4d263a0ef7e9bfd4bf61/DEPS
,
Aug 28 2017
|
||||||||||
►
Sign in to add a comment |
||||||||||
Comment 1 Deleted