ASSERT: IsValidIndex(index) |
||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6121248064274432 Fuzzer: libFuzzer_pdfium_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: ASSERT Crash Address: Crash State: IsValidIndex(index) CFX_WideString::operator CPDF_TextPage::IsHyphen Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=500291:500323 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6121248064274432 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Sep 8 2017
,
Sep 8 2017
Likely the flip of FX_STRSIZE to unsigned.
,
Sep 11 2017
Yup, that is likely the culprit. I can see in the calling code where it is possible for -- on an index of 0 to occur. I will upload a patch for this later today.
,
Sep 11 2017
,
Sep 13 2017
The following revision refers to this bug: https://pdfium.googlesource.com/pdfium/+/06c6855258bf25246c46a1f628b8a8a8185029a7 commit 06c6855258bf25246c46a1f628b8a8a8185029a7 Author: Ryan Harrison <rharrison@chromium.org> Date: Wed Sep 13 15:42:13 2017 Rewrite IsHyphen using string operations The existing code did end of range checks by making sure that the value was never less then 0. This isn't correct when using an unsigned type, since 0 - 1 will wrap around to the max possible value, and thus still be less then 0. Additionally the existing code was hard to follow due to the complexity of some of the low level operations being performed. It has been rewritten using higher level string operations to make it clearer and correct. BUG= chromium:763256 Change-Id: Ib8bf5ca0e29e73724c4a1c4781362e8a8fc30149 Reviewed-on: https://pdfium-review.googlesource.com/13690 Commit-Queue: Ryan Harrison <rharrison@chromium.org> Reviewed-by: Tom Sepez <tsepez@chromium.org> [modify] https://crrev.com/06c6855258bf25246c46a1f628b8a8a8185029a7/core/fxcrt/cfx_widetextbuf.cpp [modify] https://crrev.com/06c6855258bf25246c46a1f628b8a8a8185029a7/core/fxcrt/cfx_binarybuf.h [modify] https://crrev.com/06c6855258bf25246c46a1f628b8a8a8185029a7/core/fxcrt/cfx_widetextbuf.h [modify] https://crrev.com/06c6855258bf25246c46a1f628b8a8a8185029a7/core/fxcrt/cfx_widestring_unittest.cpp [modify] https://crrev.com/06c6855258bf25246c46a1f628b8a8a8185029a7/core/fxcrt/cfx_bytestring_unittest.cpp [modify] https://crrev.com/06c6855258bf25246c46a1f628b8a8a8185029a7/core/fpdftext/cpdf_textpage.cpp [modify] https://crrev.com/06c6855258bf25246c46a1f628b8a8a8185029a7/core/fpdftext/cpdf_textpage.h [modify] https://crrev.com/06c6855258bf25246c46a1f628b8a8a8185029a7/core/fxcrt/cfx_string_c_template.h [modify] https://crrev.com/06c6855258bf25246c46a1f628b8a8a8185029a7/core/fxcrt/cfx_binarybuf.cpp
,
Sep 13 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/0f282076b880f5db29e8a50b476e8ab294c5480d commit 0f282076b880f5db29e8a50b476e8ab294c5480d Author: pdfium-deps-roller@chromium.org <pdfium-deps-roller@chromium.org> Date: Wed Sep 13 17:22:31 2017 Roll src/third_party/pdfium/ f2ca50ffa..06c685525 (1 commit) https://pdfium.googlesource.com/pdfium.git/+log/f2ca50ffa2d2..06c6855258bf $ git log f2ca50ffa..06c685525 --date=short --no-merges --format='%ad %ae %s' 2017-09-13 rharrison Rewrite IsHyphen using string operations Created with: roll-dep src/third_party/pdfium BUG= 763256 Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, see: http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls TBR=dsinclair@chromium.org Change-Id: I95fd0446d3109077c44e88ad4326d5f0641ab9f6 Reviewed-on: https://chromium-review.googlesource.com/665257 Reviewed-by: <pdfium-deps-roller@chromium.org> Commit-Queue: <pdfium-deps-roller@chromium.org> Cr-Commit-Position: refs/heads/master@{#501673} [modify] https://crrev.com/0f282076b880f5db29e8a50b476e8ab294c5480d/DEPS
,
Sep 13 2017
,
Sep 14 2017
ClusterFuzz has detected this issue as fixed in range 501669:501735. Detailed report: https://clusterfuzz.com/testcase?key=6121248064274432 Fuzzer: libFuzzer_pdfium_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: ASSERT Crash Address: Crash State: IsValidIndex(index) CFX_WideString::operator CPDF_TextPage::IsHyphen Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=500291:500323 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=501669:501735 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6121248064274432 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Sep 14 2017
ClusterFuzz testcase 6121248064274432 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by msrchandra@chromium.org
, Sep 8 2017Labels: Test-Predator-Wrong-CLs M-63
Owner: tsepez@chromium.org
Status: Assigned (was: Untriaged)