New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 738711 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Aug 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 1
Type: Bug

Blocking:
issue 584819



Sign in to add a comment

Out-of-memory in pdf_jpx_fuzzer

Project Member Reported by ClusterFuzz, Jul 2 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5324028922560512

Fuzzer: libFuzzer_pdf_jpx_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Out-of-memory (exceeds 2048 MB)
Crash Address: 
Crash State:
  pdf_jpx_fuzzer
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=395640:395746

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5324028922560512


Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 

Comment 1 Deleted

Cc: msrchandra@chromium.org
Labels: M-60 Test-Predator-Wrong
Owner: npm@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL did not provide any possible suspects.
Using Code Search for the file, "pdf_jpx_fuzzer" assigning to the concern owner.

Suspecting Commit#
https://pdfium.googlesource.com/pdfium.git/+/37cc5fb6b3407ce8e079bc1bdd0606713b975532

@npm -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Project Member

Comment 3 by ClusterFuzz, Jul 4 2017

Labels: OS-Mac

Comment 4 by npm@chromium.org, Jul 5 2017

Components: Internals>Plugins>PDF

Comment 5 by npm@chromium.org, Jul 12 2017

Status: WontFix (was: Assigned)
Large tile sizes are allocated in opj_tcd_init_tile. The allocated data is used in different ways in multiple places, so fixing this would probably require a large refactoring of this third party library. Marking as WontFix
Project Member

Comment 6 by ClusterFuzz, Jul 19 2017

Labels: Needs-Feedback
ClusterFuzz testcase 5324028922560512 is still reproducing on tip-of-tree build (trunk).

If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase.

Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace.
Owner: dsinclair@chromium.org
Status: Assigned (was: WontFix)
Clusterfuzz wants us to look again ...

Comment 8 by mmoroz@chromium.org, Jul 28 2017

Blocking: 584819
Is there any way to reject such inputs in the fuzz target (https://cs.chromium.org/chromium/src/third_party/pdfium/testing/libfuzzer/pdf_jpx_fuzzer.cc)?

If I understood correctly, OOM is a kind of intended behavior here. If so, it would be fine to simply do "return 0;" for inputs with too large tile size. If course, if that's easy to check the size :)

This bug is a blocker for gaining new code coverage and doing efficient continuous testing, as it occurs in 84% of fuzzer runs: https://clusterfuzz.com/v2/performance-report/libFuzzer_pdf_jpx_fuzzer/libfuzzer_chrome_asan/latest
Labels: -Needs-Feedback -M-60
Owner: thestig@chromium.org
Status: Started (was: Assigned)
https://pdfium-review.googlesource.com/c/pdfium/+/11870
Project Member

Comment 10 by bugdroid1@chromium.org, Aug 28 2017

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/b0860beccd6a4a8d9f8ea3dbba392a3a13218ad3

commit b0860beccd6a4a8d9f8ea3dbba392a3a13218ad3
Author: Lei Zhang <thestig@chromium.org>
Date: Mon Aug 28 16:16:38 2017

Limit pdf_jpx_fuzzer memory usage.

BUG= chromium:738711 

Change-Id: I4a308694c3e6fcd17431515b7897969d54486071
Reviewed-on: https://pdfium-review.googlesource.com/11870
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>

[modify] https://crrev.com/b0860beccd6a4a8d9f8ea3dbba392a3a13218ad3/testing/libfuzzer/pdf_jpx_fuzzer.cc

Project Member

Comment 11 by bugdroid1@chromium.org, Aug 28 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2f439e8d6a1946b4dc4f4d263a0ef7e9bfd4bf61

commit 2f439e8d6a1946b4dc4f4d263a0ef7e9bfd4bf61
Author: pdfium-deps-roller@chromium.org <pdfium-deps-roller@chromium.org>
Date: Mon Aug 28 17:52:04 2017

Roll src/third_party/pdfium/ 133617c2d..b0860becc (4 commits)

https://pdfium.googlesource.com/pdfium.git/+log/133617c2d2b9..b0860beccd6a

$ git log 133617c2d..b0860becc --date=short --no-merges --format='%ad %ae %s'
2017-08-23 thestig Limit pdf_jpx_fuzzer memory usage.
2017-08-23 thestig Skip decoding of excessively large JBIG2 images.
2017-08-28 art-snake Unify CPDF_SyntaxParser::GetObjectXXX methods.
2017-08-28 dsinclair Add a global font loader in XFA tests

Created with:
  roll-dep src/third_party/pdfium
BUG= 738711 ,749610.


Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, see:
http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls


TBR=dsinclair@chromium.org

Change-Id: I9992d6f4f1ba5239be43366f3eab8eba9ee1cff2
Reviewed-on: https://chromium-review.googlesource.com/638610
Reviewed-by: <pdfium-deps-roller@chromium.org>
Commit-Queue: <pdfium-deps-roller@chromium.org>
Cr-Commit-Position: refs/heads/master@{#497795}
[modify] https://crrev.com/2f439e8d6a1946b4dc4f4d263a0ef7e9bfd4bf61/DEPS

Status: Fixed (was: Started)

Sign in to add a comment