New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 788716 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 793588
Owner:
Closed: Dec 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security



Sign in to add a comment

DCHECK failure in static_cast<unsigned>(length_) > static_cast<unsigned>(i) in zone.h

Project Member Reported by ClusterFuzz, Nov 27 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4872831203803136

Fuzzer: libFuzzer_v8_regexp_parser_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  static_cast<unsigned>(length_) > static_cast<unsigned>(i) in zone.h
  v8::internal::ZoneList<v8::internal::CharacterRange>::operator
  at
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=515947:515970

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4872831203803136

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 27 2017

Components: Blink>JavaScript
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Nov 27 2017

Labels: Test-Predator-Auto-Owner
Owner: erikcorry@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/04f7d484db22b1526afa5414c06eda443c5b4fad (RegExp: Add the ability to switch flags on and off within the regexp.).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 3 by sheriffbot@chromium.org, Nov 28 2017

Labels: M-64
Project Member

Comment 4 by sheriffbot@chromium.org, Nov 28 2017

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 5 by sheriffbot@chromium.org, Nov 28 2017

Labels: Pri-1
Project Member

Comment 6 by sheriffbot@chromium.org, Dec 7 2017

Labels: -Security_Impact-Head Security_Impact-Beta
Project Member

Comment 7 by sheriffbot@chromium.org, Dec 13 2017

erikcorry: Uh oh! This issue still open and hasn't been updated in the last 15 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 8 by ClusterFuzz, Dec 19 2017

ClusterFuzz has detected this issue as fixed in range 524693:524703.

Detailed report: https://clusterfuzz.com/testcase?key=4872831203803136

Fuzzer: libFuzzer_v8_regexp_parser_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  static_cast<unsigned>(length_) > static_cast<unsigned>(i) in zone.h
  v8::internal::ZoneList<v8::internal::CharacterRange>::operator
  at
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=515947:515970
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=524693:524703

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4872831203803136

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Dec 19 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 4872831203803136 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 10 by sheriffbot@chromium.org, Dec 19 2017

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 11 by sheriffbot@chromium.org, Dec 21 2017

Labels: Merge-Request-64
Project Member

Comment 12 by sheriffbot@chromium.org, Dec 21 2017

Labels: -Merge-Request-64 Hotlist-Merge-Review Merge-Review-64
This bug requires manual review: M64 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), kbleicher@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Cc: yangguo@chromium.org erikcorry@chromium.org
Owner: jgruber@chromium.org
Handing over to Gruber
Mergedinto: 793588
Status: Duplicate (was: Verified)
What is the CL that needs to be merged? If it's in the other bug, crbug/793588, can you please request merge in that bug? 
See  https://crbug.com/793588#c21 , no merge needed.
Labels: -Merge-Review-64
removing merge request per #16. 
Project Member

Comment 18 by sheriffbot@chromium.org, Mar 28 2018

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment