Divide-by-zero in mojo::edk::DataPipeProducerDispatcher::WriteData |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6153346233925632 Fuzzer: inferno_layout_test_fuzzer Job Type: windows_asan_content_shell Platform Id: windows Crash Type: Divide-by-zero Crash Address: 0x0e6b3880 Crash State: mojo::edk::DataPipeProducerDispatcher::WriteData mojo::edk::Core::WriteData MojoWriteDataImpl Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=455449:455516 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6153346233925632 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Sep 6 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/fad90d461afb7f9961f200ad164531ee980fae4f commit fad90d461afb7f9961f200ad164531ee980fae4f Author: Ken Rockot <rockot@chromium.org> Date: Wed Sep 06 23:36:33 2017 Mojo: Guard against invalid data pipe configs It's possible to create a data pipe with zero capacity or element size, which can violate other assumptions in the implementation. There's no value in creating such a pipe, so this CL prevents it. BUG= 761634 R=jcivelli@chromium.org Change-Id: Icec88cfc98b706ec6905146e34d99e5f9ea433b9 Reviewed-on: https://chromium-review.googlesource.com/653780 Reviewed-by: Jay Civelli <jcivelli@chromium.org> Commit-Queue: Ken Rockot <rockot@chromium.org> Cr-Commit-Position: refs/heads/master@{#500112} [modify] https://crrev.com/fad90d461afb7f9961f200ad164531ee980fae4f/mojo/edk/system/core.cc [modify] https://crrev.com/fad90d461afb7f9961f200ad164531ee980fae4f/mojo/edk/system/data_pipe_consumer_dispatcher.cc [modify] https://crrev.com/fad90d461afb7f9961f200ad164531ee980fae4f/mojo/edk/system/data_pipe_producer_dispatcher.cc [modify] https://crrev.com/fad90d461afb7f9961f200ad164531ee980fae4f/mojo/public/c/system/data_pipe.h
,
Sep 6 2017
,
Sep 7 2017
ClusterFuzz has detected this issue as fixed in range 500091:500116. Detailed report: https://clusterfuzz.com/testcase?key=6153346233925632 Fuzzer: inferno_layout_test_fuzzer Job Type: windows_asan_content_shell Platform Id: windows Crash Type: Divide-by-zero Crash Address: 0x0e6b3880 Crash State: mojo::edk::DataPipeProducerDispatcher::WriteData mojo::edk::Core::WriteData MojoWriteDataImpl Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=455449:455516 Fixed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=500091:500116 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6153346233925632 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Sep 7 2017
ClusterFuzz testcase 6153346233925632 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||
►
Sign in to add a comment |
|||
Comment 1 by msrchandra@chromium.org
, Sep 4 2017Components: Internals>Mojo
Labels: Test-Predator-Wrong-CLs M-61
Owner: roc...@chromium.org
Status: Assigned (was: Untriaged)