New issue
Advanced search Search tips

Issue 779890 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Oct 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug

Blocking:
issue 62400



Sign in to add a comment

Floating-point-exception in XFACodecFuzzer::Fuzz

Project Member Reported by ClusterFuzz, Oct 31 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5274173122543616

Fuzzer: afl_pdf_codec_gif_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: Floating-point-exception
Crash Address: 
Crash State:
  XFACodecFuzzer::Fuzz
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=512505:512527

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5274173122543616

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Oct 31 2017

Components: Internals>Plugins>PDF
Labels: Test-Predator-AutoComponents
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Oct 31 2017

Labels: Test-Predator-AutoOwner
Owner: rharrison@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://pdfium.googlesource.com/pdfium/+/1fc3c3b309d96b4e4f4c6d8b270a4e72710ca4a1 (Fix overflow in image size check).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
Blocking: 62400
Project Member

Comment 4 by bugdroid1@chromium.org, Oct 31 2017

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/994f20cfb76f4902491a94c4ef61f55705fc124d

commit 994f20cfb76f4902491a94c4ef61f55705fc124d
Author: Ryan Harrison <rharrison@chromium.org>
Date: Tue Oct 31 17:57:48 2017

Fix FPE in XFACodecFuzzer

This is a div by 0 issue

BUG= chromium:779890 

Change-Id: I91ca2969ffe52fb486b1fab32abc8609cd6567a2
Reviewed-on: https://pdfium-review.googlesource.com/17250
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Ryan Harrison <rharrison@chromium.org>

[modify] https://crrev.com/994f20cfb76f4902491a94c4ef61f55705fc124d/testing/libfuzzer/xfa_codec_fuzzer.h

Project Member

Comment 5 by bugdroid1@chromium.org, Oct 31 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/fbf0a167d9962c9a0c39b7139a4580aa55874de5

commit fbf0a167d9962c9a0c39b7139a4580aa55874de5
Author: pdfium-deps-roller@chromium.org <pdfium-deps-roller@chromium.org>
Date: Tue Oct 31 19:18:17 2017

Roll src/third_party/pdfium/ 367e7de07..994f20cfb (1 commit)

https://pdfium.googlesource.com/pdfium.git/+log/367e7de07ec3..994f20cfb76f

$ git log 367e7de07..994f20cfb --date=short --no-merges --format='%ad %ae %s'
2017-10-31 rharrison Fix FPE in XFACodecFuzzer

Created with:
  roll-dep src/third_party/pdfium
BUG= 779890 


The AutoRoll server is located here: https://pdfium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


TBR=dsinclair@chromium.org

Change-Id: If2f5607a9e9c06be34cb76b545d74311b076792f
Reviewed-on: https://chromium-review.googlesource.com/747070
Reviewed-by: <pdfium-deps-roller@chromium.org>
Commit-Queue: <pdfium-deps-roller@chromium.org>
Cr-Commit-Position: refs/heads/master@{#512901}
[modify] https://crrev.com/fbf0a167d9962c9a0c39b7139a4580aa55874de5/DEPS

Project Member

Comment 6 by bugdroid1@chromium.org, Oct 31 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/3108fc39e871e34e58e6603584c3c1c4155e32a0

commit 3108fc39e871e34e58e6603584c3c1c4155e32a0
Author: pdfium-deps-roller@chromium.org <pdfium-deps-roller@chromium.org>
Date: Tue Oct 31 19:43:15 2017

Roll src/third_party/pdfium/ 367e7de07..994f20cfb (1 commit)

https://pdfium.googlesource.com/pdfium.git/+log/367e7de07ec3..994f20cfb76f

$ git log 367e7de07..994f20cfb --date=short --no-merges --format='%ad %ae %s'
2017-10-31 rharrison Fix FPE in XFACodecFuzzer

Created with:
  roll-dep src/third_party/pdfium
BUG= 779890 


The AutoRoll server is located here: https://pdfium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


TBR=dsinclair@chromium.org

Change-Id: I09303f54cd1e91d3703cd680ecb07952cac9b7b9
Reviewed-on: https://chromium-review.googlesource.com/747091
Reviewed-by: <pdfium-deps-roller@chromium.org>
Commit-Queue: <pdfium-deps-roller@chromium.org>
Cr-Commit-Position: refs/heads/master@{#512910}

Project Member

Comment 7 by bugdroid1@chromium.org, Oct 31 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/37e2226d9f63a9d09644abd827d9f8e9421eb5c3

commit 37e2226d9f63a9d09644abd827d9f8e9421eb5c3
Author: pdfium-deps-roller@chromium.org <pdfium-deps-roller@chromium.org>
Date: Tue Oct 31 19:50:05 2017

Roll src/third_party/pdfium/ 367e7de07..994f20cfb (1 commit)

https://pdfium.googlesource.com/pdfium.git/+log/367e7de07ec3..994f20cfb76f

$ git log 367e7de07..994f20cfb --date=short --no-merges --format='%ad %ae %s'
2017-10-31 rharrison Fix FPE in XFACodecFuzzer

Created with:
  roll-dep src/third_party/pdfium
BUG= 779890 


The AutoRoll server is located here: https://pdfium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


TBR=dsinclair@chromium.org

Change-Id: Iee78d40a42947ff63c32f7e33f1d4b4547c03386
Reviewed-on: https://chromium-review.googlesource.com/747048
Reviewed-by: <pdfium-deps-roller@chromium.org>
Commit-Queue: <pdfium-deps-roller@chromium.org>
Cr-Commit-Position: refs/heads/master@{#512913}

Project Member

Comment 8 by bugdroid1@chromium.org, Oct 31 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/44c69f9b834a40fbea348ebee190a913ddfe4406

commit 44c69f9b834a40fbea348ebee190a913ddfe4406
Author: pdfium-deps-roller@chromium.org <pdfium-deps-roller@chromium.org>
Date: Tue Oct 31 19:51:16 2017

Roll src/third_party/pdfium/ 367e7de07..994f20cfb (1 commit)

https://pdfium.googlesource.com/pdfium.git/+log/367e7de07ec3..994f20cfb76f

$ git log 367e7de07..994f20cfb --date=short --no-merges --format='%ad %ae %s'
2017-10-31 rharrison Fix FPE in XFACodecFuzzer

Created with:
  roll-dep src/third_party/pdfium
BUG= 779890 


The AutoRoll server is located here: https://pdfium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


TBR=dsinclair@chromium.org

Change-Id: Ic72c931500743fda96bd75e74fca1531a3e8d1cc
Reviewed-on: https://chromium-review.googlesource.com/747004
Reviewed-by: <pdfium-deps-roller@chromium.org>
Commit-Queue: <pdfium-deps-roller@chromium.org>
Cr-Commit-Position: refs/heads/master@{#512915}

Project Member

Comment 9 by bugdroid1@chromium.org, Oct 31 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/5baa98abc919d86830733492273f6a58038dd145

commit 5baa98abc919d86830733492273f6a58038dd145
Author: pdfium-deps-roller@chromium.org <pdfium-deps-roller@chromium.org>
Date: Tue Oct 31 19:52:52 2017

Roll src/third_party/pdfium/ 367e7de07..994f20cfb (1 commit)

https://pdfium.googlesource.com/pdfium.git/+log/367e7de07ec3..994f20cfb76f

$ git log 367e7de07..994f20cfb --date=short --no-merges --format='%ad %ae %s'
2017-10-31 rharrison Fix FPE in XFACodecFuzzer

Created with:
  roll-dep src/third_party/pdfium
BUG= 779890 


The AutoRoll server is located here: https://pdfium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


TBR=dsinclair@chromium.org

Change-Id: I5803c09738210be2b38edab0ae07929eec2eedc4
Reviewed-on: https://chromium-review.googlesource.com/747049
Reviewed-by: <pdfium-deps-roller@chromium.org>
Commit-Queue: <pdfium-deps-roller@chromium.org>
Cr-Commit-Position: refs/heads/master@{#512918}

Project Member

Comment 10 by bugdroid1@chromium.org, Oct 31 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f7c73b691582ad2a0acf3cc9681672dae0988d13

commit f7c73b691582ad2a0acf3cc9681672dae0988d13
Author: pdfium-deps-roller@chromium.org <pdfium-deps-roller@chromium.org>
Date: Tue Oct 31 19:54:06 2017

Roll src/third_party/pdfium/ 367e7de07..994f20cfb (1 commit)

https://pdfium.googlesource.com/pdfium.git/+log/367e7de07ec3..994f20cfb76f

$ git log 367e7de07..994f20cfb --date=short --no-merges --format='%ad %ae %s'
2017-10-31 rharrison Fix FPE in XFACodecFuzzer

Created with:
  roll-dep src/third_party/pdfium
BUG= 779890 


The AutoRoll server is located here: https://pdfium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


TBR=dsinclair@chromium.org

Change-Id: I3d0190fc620bf65484c87ee6f013cd502b30d419
Reviewed-on: https://chromium-review.googlesource.com/747084
Reviewed-by: <pdfium-deps-roller@chromium.org>
Commit-Queue: <pdfium-deps-roller@chromium.org>
Cr-Commit-Position: refs/heads/master@{#512920}

Status: Fixed (was: Assigned)
Project Member

Comment 12 by bugdroid1@chromium.org, Oct 31 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e7b5b73ce35e5d9eaabe85766e958a607988eada

commit e7b5b73ce35e5d9eaabe85766e958a607988eada
Author: pdfium-deps-roller@chromium.org <pdfium-deps-roller@chromium.org>
Date: Tue Oct 31 20:21:30 2017

Roll src/third_party/pdfium/ 367e7de07..994f20cfb (1 commit)

https://pdfium.googlesource.com/pdfium.git/+log/367e7de07ec3..994f20cfb76f

$ git log 367e7de07..994f20cfb --date=short --no-merges --format='%ad %ae %s'
2017-10-31 rharrison Fix FPE in XFACodecFuzzer

Created with:
  roll-dep src/third_party/pdfium
BUG= 779890 


The AutoRoll server is located here: https://pdfium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


TBR=dsinclair@chromium.org

Change-Id: I4aedc805b8c500ba8a91cfe689f395bea53233d6
Reviewed-on: https://chromium-review.googlesource.com/747484
Reviewed-by: <pdfium-deps-roller@chromium.org>
Commit-Queue: <pdfium-deps-roller@chromium.org>
Cr-Commit-Position: refs/heads/master@{#512932}

Project Member

Comment 13 by bugdroid1@chromium.org, Oct 31 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4b7f956cc752083d264da5c09a36318fc7788365

commit 4b7f956cc752083d264da5c09a36318fc7788365
Author: pdfium-deps-roller@chromium.org <pdfium-deps-roller@chromium.org>
Date: Tue Oct 31 20:21:57 2017

Roll src/third_party/pdfium/ 367e7de07..994f20cfb (1 commit)

https://pdfium.googlesource.com/pdfium.git/+log/367e7de07ec3..994f20cfb76f

$ git log 367e7de07..994f20cfb --date=short --no-merges --format='%ad %ae %s'
2017-10-31 rharrison Fix FPE in XFACodecFuzzer

Created with:
  roll-dep src/third_party/pdfium
BUG= 779890 


The AutoRoll server is located here: https://pdfium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


TBR=dsinclair@chromium.org

Change-Id: I5776e3e86fe580904b02f4fe2da25b55652e1899
Reviewed-on: https://chromium-review.googlesource.com/747122
Reviewed-by: <pdfium-deps-roller@chromium.org>
Commit-Queue: <pdfium-deps-roller@chromium.org>
Cr-Commit-Position: refs/heads/master@{#512933}

Project Member

Comment 14 by bugdroid1@chromium.org, Oct 31 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7ea0d61311ffb8cea26bca386fb1456976922518

commit 7ea0d61311ffb8cea26bca386fb1456976922518
Author: pdfium-deps-roller@chromium.org <pdfium-deps-roller@chromium.org>
Date: Tue Oct 31 20:23:48 2017

Roll src/third_party/pdfium/ 367e7de07..994f20cfb (1 commit)

https://pdfium.googlesource.com/pdfium.git/+log/367e7de07ec3..994f20cfb76f

$ git log 367e7de07..994f20cfb --date=short --no-merges --format='%ad %ae %s'
2017-10-31 rharrison Fix FPE in XFACodecFuzzer

Created with:
  roll-dep src/third_party/pdfium
BUG= 779890 


The AutoRoll server is located here: https://pdfium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


TBR=dsinclair@chromium.org

Change-Id: I7251493ee6a526208e78332dc5bb48a60e23b377
Reviewed-on: https://chromium-review.googlesource.com/747124
Reviewed-by: <pdfium-deps-roller@chromium.org>
Commit-Queue: <pdfium-deps-roller@chromium.org>
Cr-Commit-Position: refs/heads/master@{#512935}

Project Member

Comment 15 by ClusterFuzz, Nov 1 2017

ClusterFuzz has detected this issue as fixed in range 512886:512926.

Detailed report: https://clusterfuzz.com/testcase?key=5274173122543616

Fuzzer: afl_pdf_codec_gif_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: Floating-point-exception
Crash Address: 
Crash State:
  XFACodecFuzzer::Fuzz
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=512505:512527
Fixed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=512886:512926

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5274173122543616

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 16 by ClusterFuzz, Nov 1 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 5274173122543616 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Labels: Test-Predator-Auto-CC
Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components
Labels: -Test-Predator-AutoOwner Test-Predator-Auto-Owner
Labels: -Test-Predator-Auto-CC

Sign in to add a comment