This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.
If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.
For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
I've done some debugging, not sure exactly what's happening here but the attribute parser hits this error about the input:
https://cs.chromium.org/chromium/src/third_party/libxml/src/parser.c?type=cs&l=9625
The context is looking at:
<!ENTITY%MEN>\n\t\t\t\t<par md=\"10\" h=\"3bPD21CD21C\"><par iVd=\"n ve\" without
and it's unpacked one attribute successfully, the iVd="n ve" one.
Then there's this gem:
/*
* Arithmetic on dangling pointers is technically undefined
* behavior, but well...
*/
ptrdiff_t offset = ctxt->input->base - atts[i+2];
And atts gets messed up right after this point. I think this is another case of GROW or whatever flipping the context base into an entity it is expanding while some other part of the parser is holding onto a pointer into another buffer.
[Bulk Edit]
URGENT - PTAL.
Your bug is labelled as M61 Stable ReleaseBlock, pls make sure to land the fix and get it merged into the release branch ASAP.
Know that this issue shouldn't block the release? Remove the ReleaseBlock-Stable label.
Thank you.
This bug requires manual review: M61 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: amineer@(Android), cmasso@(iOS), ketakid@(ChromeOS), govind@(Desktop)
For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
ClusterFuzz testcase 5091504392765440 is verified as fixed, so closing issue as verified.
If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Comment 1 by vakh@chromium.org
, Jul 27 2017Owner: dominicc@chromium.org
Status: Assigned (was: Untriaged)