New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 761666 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Oct 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Integer-overflow in CJBig2_ArithIntDecoder::decode

Project Member Reported by ClusterFuzz, Sep 3 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6054859278385152

Fuzzer: libFuzzer_pdf_codec_jbig2_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  CJBig2_ArithIntDecoder::decode
  CJBig2_SDDProc::decode_Arith
  CJBig2_Context::parseSymbolDict
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=421422:421461

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6054859278385152

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org
Labels: M-61 Test-Predator-Wrong-CLs
Owner: dsinclair@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using Code Search for the file, "JBig2_ArithIntDecoder.cpp" assigning to concern owner who previously worked on similar file.

@dsinclair -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Cc: dsinclair@chromium.org
Owner: hnakashima@chromium.org
hnakashima@ can you take a look?
Status: Started (was: Assigned)
Project Member

Comment 4 by bugdroid1@chromium.org, Sep 14 2017

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/3cb71268405f64b98109853bd3b59e50db58692d

commit 3cb71268405f64b98109853bd3b59e50db58692d
Author: Henrique Nakashima <hnakashima@chromium.org>
Date: Thu Sep 14 21:43:02 2017

Fix decoding of JBIG2 integers for values with large magnitude.

Now considering anything not representable by a 32-bit signed int
as OOB rather than decoding some arbitrary overflowed value.

Bug:  chromium:761666 
Change-Id: I00f5a3abadca51f9bedc5e5d78f7f184040c2f33
Reviewed-on: https://pdfium-review.googlesource.com/14010
Commit-Queue: Henrique Nakashima <hnakashima@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Ryan Harrison <rharrison@chromium.org>

[modify] https://crrev.com/3cb71268405f64b98109853bd3b59e50db58692d/core/fxcodec/jbig2/JBig2_ArithIntDecoder.cpp

Components: Internals>Plugins>PDF
Status: Fixed (was: Started)
Project Member

Comment 7 by ClusterFuzz, Oct 1 2017

Labels: Test-Predator-AutoComponents
Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 8 by ClusterFuzz, Oct 2 2017

Labels: Needs-Feedback
ClusterFuzz testcase 6054859278385152 is still reproducing on tip-of-tree build (trunk).

Please re-test your fix against this testcase and if the fix was incorrect or incomplete, please re-open the bug. Otherwise, ignore this notification and add ClusterFuzz-Wrong label.
Status: Assigned (was: Fixed)
hnakashima@ can you give this a re-test to see if we're hitting something new?
I just tested on head and it did not repro locally.

This was fixed by a CL rolled to revision 502131 and clusterfuzz shows the latest stack trace at 502108, which is right before it. These were both on Sep 14 though, so not sure why it pinged us today to say it's still reproducing.
Labels: ClusterFuzz-Wrong
Status: Fixed (was: Assigned)
Project Member

Comment 12 by ClusterFuzz, Oct 4 2017

ClusterFuzz has detected this issue as fixed in range 502108:506092.

Detailed report: https://clusterfuzz.com/testcase?key=6054859278385152

Fuzzer: libFuzzer_pdf_codec_jbig2_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  CJBig2_ArithIntDecoder::decode
  CJBig2_SDDProc::decode_Arith
  CJBig2_Context::parseSymbolDict
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=421422:421461
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=502108:506092

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6054859278385152

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components

Sign in to add a comment