Stack-overflow in Parser::ParseExpression |
||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4876903973650432 Fuzzer: libFuzzer_gn_parser_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Stack-overflow Crash Address: 0x7ffee88eae68 Crash State: Parser::ParseExpression Parser::DotOperator Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=414068:414164 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4876903973650432 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Nov 2 2017
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/e47a47636163bd171399c6426e834837a52b75b7 (Add a fuzzer for gn's parser.). If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
,
Nov 3 2017
Well, it appears there are more tokens that may lead to stack overflow, e.g. this particular crash happens with the following input: $ cat clusterfuzz-testcase-6506407989084160 | xxd 00000000: 543d 543d 543d 543d 543d 543d 543d 543d T=T=T=T=T=T=T=T= 00000010: 543d 543d 543d 543d 543d 543d 543d 543d T=T=T=T=T=T=T=T= 00000020: 543d 543d 543d 543d 543d 543d 543d 543d T=T=T=T=T=T=T=T= <...> Adding Token::EQUALS to the sanity check function helps to avoid crashing, but we are not sure whether it makes sense to do since the fuzzer future existence is questionable.
,
Nov 7 2017
,
Nov 7 2017
,
Nov 7 2017
,
Nov 7 2017
,
Jan 28 2018
ClusterFuzz has detected this issue as fixed in range 532258:532261. Detailed report: https://clusterfuzz.com/testcase?key=4876903973650432 Fuzzer: libFuzzer_gn_parser_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Stack-overflow Crash Address: 0x7ffee88eae68 Crash State: Parser::ParseExpression Parser::DotOperator Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=414068:414164 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=532258:532261 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4876903973650432 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jan 28 2018
ClusterFuzz testcase 4876903973650432 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||||||
►
Sign in to add a comment |
||||||||
Comment 1 by ClusterFuzz
, Nov 2 2017Labels: Test-Predator-AutoComponents