CHECK failure: renormalize_success in verify_name_match_normalizename_fuzzer.cc |
||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4520917387706368 Fuzzer: libFuzzer_net_cert_normalize_name_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: renormalize_success in verify_name_match_normalizename_fuzzer.cc verify_name_match_normalizename_fuzzer.cc Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=520161:520202 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4520917387706368 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Dec 1 2017
Predator and CL could not provide any possible suspects. Using the code search for the file, “verify_name_match_normalizename_fuzzer.cc” assigning to concern owner from GIT revision log. Suspecting Commit# https://chromium.googlesource.com/chromium/src/+/7b45a27c473f13756026dd4d066bb42529c694cb @eroman -- Could you please look into this issue as you have worked on the suspect file recently, kindly reassign if it has nothing to do with your changes. Thank You. Issue seems to be similar to the Issue 789909 .
,
Dec 2 2017
Looks like this was caused by boringssl roll cef79db9440394f1d0198240991da0009e6368a1 and already fixed by roll 53b449d1ef4305a6f52161bd0b921b30d179b029. The relevant boringssl CLs: https://boringssl.googlesource.com/boringssl/+/66801feb175599a6d1eb3845eb7ce0ca84551fb5 and https://boringssl.googlesource.com/boringssl/+/2fc4f362cdaab103241a6a3ca1bf16778944f36b. I guess predator will automatically close this bug once it tries rerunning with the new deps? David: are you tracking places in chrome that were affected by that change somewhere? (I uploaded a CL with the test cases here: https://chromium-review.googlesource.com/#/c/chromium/src/+/804718, makes it a bit quicker to repro that running the clusterfuzz script.)
,
Dec 2 2017
ClusterFuzz has detected this issue as fixed in range 521019:521065. Detailed report: https://clusterfuzz.com/testcase?key=4520917387706368 Fuzzer: libFuzzer_net_cert_normalize_name_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: renormalize_success in verify_name_match_normalizename_fuzzer.cc verify_name_match_normalizename_fuzzer.cc Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=520161:520202 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=521019:521065 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4520917387706368 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Dec 2 2017
ClusterFuzz testcase 4520917387706368 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Dec 4 2017
Huh, I thought I'd fixed the Chromium code which was sensitive to this already. I guess not. :-/ I see the issue, which is that this line here assumes der::Tag and CBS use the same in-memory tag representation. Hrmf. I'll have to fiddle with that a bit. https://cs.chromium.org/chromium/src/net/cert/internal/verify_name_match.cc?type=cs&q=NormalizeName&sq=package:chromium&l=388
,
Dec 4 2017
Oof. Annoyingly, M64 branched with the issue still there. :-( Hey TPMs, could we cherry-pick the following change into M64? Thanks! It's just a revert. M64 happened to branch in between two changes. https://boringssl.googlesource.com/boringssl/+/2fc4f362cdaab103241a6a3ca1bf16778944f36b
,
Dec 5 2017
+abdulsyed
,
Dec 5 2017
Your change meets the bar and is auto-approved for M64. Please go ahead and merge the CL to branch 3282 manually. Please contact milestone owner if you have questions. Owners: cmasso@(Android), cmasso@(iOS), kbleicher@(ChromeOS), abdulsyed@(Desktop) For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Dec 7 2017
Merge is here. Looks like I need a TPM to review it. https://chrome-internal-review.googlesource.com/c/chrome/tools/buildspec/+/523878
,
Dec 8 2017
The following revision refers to this bug: https://chrome-internal.googlesource.com/chrome/tools/buildspec/+/218f7d372d6afcd3f307ca59a35ff7654f00d904 commit 218f7d372d6afcd3f307ca59a35ff7654f00d904 Author: David Benjamin <davidben@google.com> Date: Fri Dec 08 16:54:47 2017
,
Dec 11 2017
This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible! If all merges have been completed, please remove any remaining Merge-Approved labels from this issue. Thanks for your time! To disable nags, add the Disable-Nags label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Dec 11 2017
The merge completed as above.
,
Dec 15 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/c4dd10518c291c20a9881e6720d8b9a9505c2010 commit c4dd10518c291c20a9881e6720d8b9a9505c2010 Author: David Benjamin <davidben@chromium.org> Date: Fri Dec 15 21:23:17 2017 Add a regression test for normalizing custom attributes. A recent BoringSSL change broke this. Add a regression test for it before I try to make the change again. Bug: 789802 Change-Id: Ibe021424fc6b36b2ef71d91b30f523a2cfae1482 Reviewed-on: https://chromium-review.googlesource.com/828381 Commit-Queue: Matt Mueller <mattm@chromium.org> Reviewed-by: Matt Mueller <mattm@chromium.org> Cr-Commit-Position: refs/heads/master@{#524467} [modify] https://crrev.com/c4dd10518c291c20a9881e6720d8b9a9505c2010/net/BUILD.gn [modify] https://crrev.com/c4dd10518c291c20a9881e6720d8b9a9505c2010/net/cert/internal/verify_name_match_unittest.cc [add] https://crrev.com/c4dd10518c291c20a9881e6720d8b9a9505c2010/net/data/verify_name_match_unittest/names/custom-custom-normalized.pem |
||||||||
►
Sign in to add a comment |
||||||||
Comment 1 by ClusterFuzz
, Nov 30 2017Labels: Test-Predator-Auto-Components