This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Likely culprit CL: https://chromium-review.googlesource.com/535233

[Bulk Edit]
URGENT - PTAL.
Your bug is labelled as M61 Stable ReleaseBlock, pls make sure to land the fix and get it merged into the release branch ASAP.

Know that this issue shouldn't block the release?  Remove the ReleaseBlock-Stable label.

Thank you.

I haven't looked at this at all. Dominic, do you know if there's any report/fix for this upstream? Otherwise, we'll have to punt to 62 I think.

I looked at this in the debugger and I don't *think* it is a dup of  Issue 749397  but I'm not sure. The roll to 27f310d453b7e2e71847e5910a0961753aacdbd1 also appears to fix this though, FWIW.

(for reference the roll mentioned in #9 is https://chromium.googlesource.com/chromium/src.git/+/b45feac7b70febccd2ea06a787e7d23cfc35e103) 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5

commit cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5
Author: Dominic Cooney <dominicc@chromium.org>
Date: Mon Aug 14 03:55:00 2017

Roll libxml to 27f310d453b7e2e71847e5910a0961753aacdbd1

Bug:  749397 , 750430 
Change-Id: Id15d1ebcc54a7dc70fb869622b9acb85770bf367
Reviewed-on: https://chromium-review.googlesource.com/609563
Commit-Queue: Dominic Cooney <dominicc@chromium.org>
Reviewed-by: Scott Graham <scottmg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#494008}
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/WebKit/LayoutTests/http/tests/security/xss-DENIED-xsl-external-entity-expected.txt
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/README.chromium
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/ChangeLog
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/HTMLparser.c
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/Makefile.am
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/Makefile.in
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/SAX2.c
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/buf.c
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/dict.c
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/encoding.c
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/error.c
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/hash.c
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/include/libxml/HTMLparser.h
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/include/libxml/schemasInternals.h
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/include/libxml/xmlreader.h
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/libxml.m4
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/libxml2.spec
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/list.c
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/nanohttp.c
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/parser.c
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/parserInternals.c
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/runtest.c
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/testThreads.c
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/threads.c
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/tree.c
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/valid.c
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/xmlIO.c
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/xmlmemory.c
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/xmlreader.c
[modify] https://crrev.com/cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5/third_party/libxml/src/xmlstring.c

This bug requires manual review: M61 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: amineer@(Android), cmasso@(iOS), ketakid@(ChromeOS), govind@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

+awhalley@ for M61 merge review (CL at c#11 didn't make it to canary yet)

ClusterFuzz has detected this issue as fixed in range 494006:494012.

Detailed report: https://clusterfuzz.com/testcase?key=6462127291498496

Fuzzer: libFuzzer_libxml_xml_read_memory_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Heap-buffer-overflow READ 2
Crash Address: 0x612000000f37
Crash State:
  xmlStrndup
  xmlSAX2TextNode
  xmlSAX2AttributeNs
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=480737:480767
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=494006:494012

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6462127291498496

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6462127291498496 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Approving merge for M61 Chrome OS.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/520bbb7e468bdbce3d52b11b2bb576cd50e92316

commit 520bbb7e468bdbce3d52b11b2bb576cd50e92316
Author: Dominic Cooney <dominicc@chromium.org>
Date: Tue Aug 15 01:09:02 2017

Roll libxml to 27f310d453b7e2e71847e5910a0961753aacdbd1

TBR=dominicc@chromium.org

(cherry picked from commit cc6c1eb1271f22d3d3aaef1d9ae0053dd22b3fa5)

Bug:  749397 , 750430 
Change-Id: Id15d1ebcc54a7dc70fb869622b9acb85770bf367
Reviewed-on: https://chromium-review.googlesource.com/609563
Commit-Queue: Dominic Cooney <dominicc@chromium.org>
Reviewed-by: Scott Graham <scottmg@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#494008}
Reviewed-on: https://chromium-review.googlesource.com/614924
Reviewed-by: Dominic Cooney <dominicc@chromium.org>
Cr-Commit-Position: refs/branch-heads/3163@{#565}
Cr-Branched-From: ff259bab28b35d242e10186cd63af7ed404fae0d-refs/heads/master@{#488528}
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/WebKit/LayoutTests/http/tests/security/xss-DENIED-xsl-external-entity-expected.txt
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/README.chromium
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/ChangeLog
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/HTMLparser.c
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/Makefile.am
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/Makefile.in
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/SAX2.c
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/buf.c
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/dict.c
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/encoding.c
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/error.c
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/hash.c
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/include/libxml/HTMLparser.h
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/include/libxml/schemasInternals.h
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/include/libxml/xmlreader.h
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/libxml.m4
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/libxml2.spec
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/list.c
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/nanohttp.c
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/parser.c
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/parserInternals.c
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/runtest.c
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/testThreads.c
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/threads.c
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/tree.c
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/valid.c
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/xmlIO.c
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/xmlmemory.c
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/xmlreader.c
[modify] https://crrev.com/520bbb7e468bdbce3d52b11b2bb576cd50e92316/third_party/libxml/src/xmlstring.c

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot