Integer-overflow in CJBig2_ArithIntDecoder::decode |
||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6054859278385152 Fuzzer: libFuzzer_pdf_codec_jbig2_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: CJBig2_ArithIntDecoder::decode CJBig2_SDDProc::decode_Arith CJBig2_Context::parseSymbolDict Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=421422:421461 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6054859278385152 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Sep 5 2017
hnakashima@ can you take a look?
,
Sep 13 2017
,
Sep 14 2017
The following revision refers to this bug: https://pdfium.googlesource.com/pdfium/+/3cb71268405f64b98109853bd3b59e50db58692d commit 3cb71268405f64b98109853bd3b59e50db58692d Author: Henrique Nakashima <hnakashima@chromium.org> Date: Thu Sep 14 21:43:02 2017 Fix decoding of JBIG2 integers for values with large magnitude. Now considering anything not representable by a 32-bit signed int as OOB rather than decoding some arbitrary overflowed value. Bug: chromium:761666 Change-Id: I00f5a3abadca51f9bedc5e5d78f7f184040c2f33 Reviewed-on: https://pdfium-review.googlesource.com/14010 Commit-Queue: Henrique Nakashima <hnakashima@chromium.org> Reviewed-by: Tom Sepez <tsepez@chromium.org> Reviewed-by: Ryan Harrison <rharrison@chromium.org> [modify] https://crrev.com/3cb71268405f64b98109853bd3b59e50db58692d/core/fxcodec/jbig2/JBig2_ArithIntDecoder.cpp
,
Sep 18 2017
,
Sep 25 2017
,
Oct 1 2017
Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.
,
Oct 2 2017
ClusterFuzz testcase 6054859278385152 is still reproducing on tip-of-tree build (trunk). Please re-test your fix against this testcase and if the fix was incorrect or incomplete, please re-open the bug. Otherwise, ignore this notification and add ClusterFuzz-Wrong label.
,
Oct 2 2017
hnakashima@ can you give this a re-test to see if we're hitting something new?
,
Oct 2 2017
I just tested on head and it did not repro locally. This was fixed by a CL rolled to revision 502131 and clusterfuzz shows the latest stack trace at 502108, which is right before it. These were both on Sep 14 though, so not sure why it pinged us today to say it's still reproducing.
,
Oct 2 2017
,
Oct 4 2017
ClusterFuzz has detected this issue as fixed in range 502108:506092. Detailed report: https://clusterfuzz.com/testcase?key=6054859278385152 Fuzzer: libFuzzer_pdf_codec_jbig2_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: CJBig2_ArithIntDecoder::decode CJBig2_SDDProc::decode_Arith CJBig2_Context::parseSymbolDict Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=421422:421461 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=502108:506092 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6054859278385152 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 7 2017
|
||||||||||
►
Sign in to add a comment |
||||||||||
Comment 1 by msrchandra@chromium.org
, Sep 4 2017Labels: M-61 Test-Predator-Wrong-CLs
Owner: dsinclair@chromium.org
Status: Assigned (was: Untriaged)