New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 754972 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Last visit 25 days ago
Closed: Oct 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 2
Type: Bug



Sign in to add a comment

Stack-overflow in Parser::ParseList

Project Member Reported by ClusterFuzz, Aug 12 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5699774153228288

Fuzzer: libFuzzer_gn_parser_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Stack-overflow
Crash Address: 0x7ffc46179e48
Crash State:
  Parser::ParseList
  Parser::IdentifierOrCall
  Parser::Name
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=414068:414164

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5699774153228288

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Aug 15 2017

Labels: OS-Mac
Labels: Pri-2
Stack-overflow, Out of memory and Timeout issues are 'P2'.
Cc: msrchandra@chromium.org dcheng@chromium.org scottmg@chromium.org
Labels: M-63 CF-NeedsTriage Test-Predator-Wrong
Unable to find the possible suspect using CL, Code Search and Predator.
Adding related Devs in Cc. Could some one please look into the issue.
Thank You.
Project Member

Comment 4 by ClusterFuzz, Oct 1 2017

Components: Build
Labels: Test-Predator-AutoComponents
Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.
Owner: brettw@chromium.org
Status: Assigned (was: Untriaged)
This is a simple stack overflow. Not sure if GN wants to try to defend against this by explicitly limiting the depth of the parse tree.

Comment 6 by mmoroz@chromium.org, Oct 24 2017

For more information, please see https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md.

The link referenced in the description is no longer valid.

(bulk edit)
Project Member

Comment 7 by bugdroid1@chromium.org, Oct 30 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/697f302d91e7ad4466416ab22c290c7fea9c6b93

commit 697f302d91e7ad4466416ab22c290c7fea9c6b93
Author: Penny MacNeil <pennymac@chromium.org>
Date: Mon Oct 30 21:29:41 2017

[GN fuzzer] Stack overflow fix.

Fuzzathon 2017.

Bug:  648076 , 749793 , 773426 , 768111 , 754972 , 734401 , 734200 
Change-Id: Ic608c5a374252809443a879ad4e2ddf8f6184697
Reviewed-on: https://chromium-review.googlesource.com/736159
Commit-Queue: Penny MacNeil <pennymac@chromium.org>
Reviewed-by: Nico Weber <thakis@chromium.org>
Reviewed-by: Dirk Pranke <dpranke@chromium.org>
Reviewed-by: Max Moroz <mmoroz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#512626}
[modify] https://crrev.com/697f302d91e7ad4466416ab22c290c7fea9c6b93/tools/gn/parser_fuzzer.cc

Project Member

Comment 8 by ClusterFuzz, Oct 31 2017

ClusterFuzz has detected this issue as fixed in range 512623:512649.

Detailed report: https://clusterfuzz.com/testcase?key=5699774153228288

Fuzzer: libFuzzer_gn_parser_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Stack-overflow
Crash Address: 0x7ffda0184f00
Crash State:
  Parser::IdentifierOrCall
  Parser::Name
  Parser::ParseExpression
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=414068:414164
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=512623:512649

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5699774153228288

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Oct 31 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5699774153228288 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components

Sign in to add a comment