New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 763256 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Sep 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

ASSERT: IsValidIndex(index)

Project Member Reported by ClusterFuzz, Sep 8 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6121248064274432

Fuzzer: libFuzzer_pdfium_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  IsValidIndex(index)
  CFX_WideString::operator
  CPDF_TextPage::IsHyphen
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=500291:500323

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6121248064274432

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org
Labels: Test-Predator-Wrong-CLs M-63
Owner: tsepez@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using Code Search for the file, "cfx_widestring.h" assigning to concern owner from GIT Blame.

Suspecting Commit#
https://pdfium.googlesource.com/pdfium.git/+/fcdb2df009796a78369a7fe8bcaab76b27f5450b

@tsepez -- Could you please look into the issue, kindly re-assign if it has nothing to do with your changes.
Thank You.
Owner: dsinclair@chromium.org
Owner: rharrison@chromium.org
Likely the flip of FX_STRSIZE to unsigned.
Yup, that is likely the culprit. I can see in the calling code where it is possible for  -- on an index of 0 to occur. I will upload a patch for this later today.
Status: Started (was: Assigned)
Project Member

Comment 6 by bugdroid1@chromium.org, Sep 13 2017

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/06c6855258bf25246c46a1f628b8a8a8185029a7

commit 06c6855258bf25246c46a1f628b8a8a8185029a7
Author: Ryan Harrison <rharrison@chromium.org>
Date: Wed Sep 13 15:42:13 2017

Rewrite IsHyphen using string operations

The existing code did end of range checks by making sure that the 
value was never less then 0. This isn't correct when using an unsigned
type, since 0 - 1 will wrap around to the max possible value, and
thus still be less then 0. Additionally the existing code was hard to
follow due to the complexity of some of the low level operations being 
performed.

It has been rewritten using higher level string operations to make it
clearer and correct.

BUG= chromium:763256 

Change-Id: Ib8bf5ca0e29e73724c4a1c4781362e8a8fc30149
Reviewed-on: https://pdfium-review.googlesource.com/13690
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>

[modify] https://crrev.com/06c6855258bf25246c46a1f628b8a8a8185029a7/core/fxcrt/cfx_widetextbuf.cpp
[modify] https://crrev.com/06c6855258bf25246c46a1f628b8a8a8185029a7/core/fxcrt/cfx_binarybuf.h
[modify] https://crrev.com/06c6855258bf25246c46a1f628b8a8a8185029a7/core/fxcrt/cfx_widetextbuf.h
[modify] https://crrev.com/06c6855258bf25246c46a1f628b8a8a8185029a7/core/fxcrt/cfx_widestring_unittest.cpp
[modify] https://crrev.com/06c6855258bf25246c46a1f628b8a8a8185029a7/core/fxcrt/cfx_bytestring_unittest.cpp
[modify] https://crrev.com/06c6855258bf25246c46a1f628b8a8a8185029a7/core/fpdftext/cpdf_textpage.cpp
[modify] https://crrev.com/06c6855258bf25246c46a1f628b8a8a8185029a7/core/fpdftext/cpdf_textpage.h
[modify] https://crrev.com/06c6855258bf25246c46a1f628b8a8a8185029a7/core/fxcrt/cfx_string_c_template.h
[modify] https://crrev.com/06c6855258bf25246c46a1f628b8a8a8185029a7/core/fxcrt/cfx_binarybuf.cpp

Project Member

Comment 7 by bugdroid1@chromium.org, Sep 13 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0f282076b880f5db29e8a50b476e8ab294c5480d

commit 0f282076b880f5db29e8a50b476e8ab294c5480d
Author: pdfium-deps-roller@chromium.org <pdfium-deps-roller@chromium.org>
Date: Wed Sep 13 17:22:31 2017

Roll src/third_party/pdfium/ f2ca50ffa..06c685525 (1 commit)

https://pdfium.googlesource.com/pdfium.git/+log/f2ca50ffa2d2..06c6855258bf

$ git log f2ca50ffa..06c685525 --date=short --no-merges --format='%ad %ae %s'
2017-09-13 rharrison Rewrite IsHyphen using string operations

Created with:
  roll-dep src/third_party/pdfium
BUG= 763256 


Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, see:
http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls


TBR=dsinclair@chromium.org

Change-Id: I95fd0446d3109077c44e88ad4326d5f0641ab9f6
Reviewed-on: https://chromium-review.googlesource.com/665257
Reviewed-by: <pdfium-deps-roller@chromium.org>
Commit-Queue: <pdfium-deps-roller@chromium.org>
Cr-Commit-Position: refs/heads/master@{#501673}
[modify] https://crrev.com/0f282076b880f5db29e8a50b476e8ab294c5480d/DEPS

Status: Fixed (was: Started)
Project Member

Comment 9 by ClusterFuzz, Sep 14 2017

ClusterFuzz has detected this issue as fixed in range 501669:501735.

Detailed report: https://clusterfuzz.com/testcase?key=6121248064274432

Fuzzer: libFuzzer_pdfium_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  IsValidIndex(index)
  CFX_WideString::operator
  CPDF_TextPage::IsHyphen
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=500291:500323
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=501669:501735

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6121248064274432

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 10 by ClusterFuzz, Sep 14 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 6121248064274432 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment