New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 789802 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Dec 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: renormalize_success in verify_name_match_normalizename_fuzzer.cc

Project Member Reported by ClusterFuzz, Nov 30 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4520917387706368

Fuzzer: libFuzzer_net_cert_normalize_name_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  renormalize_success in verify_name_match_normalizename_fuzzer.cc
  verify_name_match_normalizename_fuzzer.cc
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=520161:520202

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4520917387706368

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 30 2017

Components: Internals>Core
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: msrchandra@chromium.org pnangunoori@chromium.org mattm@chromium.org
Labels: M-64 Test-Predator-Wrong
Owner: eroman@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using the code search for the file, “verify_name_match_normalizename_fuzzer.cc” assigning to concern owner from GIT revision log.
Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/7b45a27c473f13756026dd4d066bb42529c694cb

@eroman -- Could you please look into this issue as you have worked on the suspect file recently, kindly reassign if it has nothing to do with your changes.

Thank You.

Issue seems to be similar to the  Issue 789909 .

Comment 3 by mattm@chromium.org, Dec 2 2017

Cc: -mattm@chromium.org eroman@chromium.org davidben@chromium.org
Components: -Internals>Core Internals>Network>Certificate
Owner: mattm@chromium.org
Looks like this was caused by boringssl roll cef79db9440394f1d0198240991da0009e6368a1 and already fixed by roll 53b449d1ef4305a6f52161bd0b921b30d179b029.

The relevant boringssl CLs: https://boringssl.googlesource.com/boringssl/+/66801feb175599a6d1eb3845eb7ce0ca84551fb5 and https://boringssl.googlesource.com/boringssl/+/2fc4f362cdaab103241a6a3ca1bf16778944f36b.

I guess predator will automatically close this bug once it tries rerunning with the new deps?

David: are you tracking places in chrome that were affected by that change somewhere?

(I uploaded a CL with the test cases here: https://chromium-review.googlesource.com/#/c/chromium/src/+/804718, makes it a bit quicker to repro that running the clusterfuzz script.)
Project Member

Comment 4 by ClusterFuzz, Dec 2 2017

ClusterFuzz has detected this issue as fixed in range 521019:521065.

Detailed report: https://clusterfuzz.com/testcase?key=4520917387706368

Fuzzer: libFuzzer_net_cert_normalize_name_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  renormalize_success in verify_name_match_normalizename_fuzzer.cc
  verify_name_match_normalizename_fuzzer.cc
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=520161:520202
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=521019:521065

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4520917387706368

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Dec 2 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 4520917387706368 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Huh, I thought I'd fixed the Chromium code which was sensitive to this already. I guess not. :-/

I see the issue, which is that this line here assumes der::Tag and CBS use the same in-memory tag representation. Hrmf. I'll have to fiddle with that a bit.
https://cs.chromium.org/chromium/src/net/cert/internal/verify_name_match.cc?type=cs&q=NormalizeName&sq=package:chromium&l=388
Labels: Merge-Request-64
Oof. Annoyingly, M64 branched with the issue still there. :-( Hey TPMs, could we cherry-pick the following change into M64? Thanks! It's just a revert. M64 happened to branch in between two changes.

https://boringssl.googlesource.com/boringssl/+/2fc4f362cdaab103241a6a3ca1bf16778944f36b
Cc: abdulsyed@chromium.org
+abdulsyed
Project Member

Comment 9 by sheriffbot@chromium.org, Dec 5 2017

Labels: -Merge-Request-64 Hotlist-Merge-Approved Merge-Approved-64
Your change meets the bar and is auto-approved for M64. Please go ahead and merge the CL to branch 3282 manually. Please contact milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), kbleicher@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Merge is here. Looks like I need a TPM to review it.
https://chrome-internal-review.googlesource.com/c/chrome/tools/buildspec/+/523878
Project Member

Comment 11 by bugdroid1@chromium.org, Dec 8 2017

The following revision refers to this bug:
  https://chrome-internal.googlesource.com/chrome/tools/buildspec/+/218f7d372d6afcd3f307ca59a35ff7654f00d904

commit 218f7d372d6afcd3f307ca59a35ff7654f00d904
Author: David Benjamin <davidben@google.com>
Date: Fri Dec 08 16:54:47 2017

Project Member

Comment 12 by sheriffbot@chromium.org, Dec 11 2017

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: -Merge-Approved-64
The merge completed as above.
Project Member

Comment 14 by bugdroid1@chromium.org, Dec 15 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c4dd10518c291c20a9881e6720d8b9a9505c2010

commit c4dd10518c291c20a9881e6720d8b9a9505c2010
Author: David Benjamin <davidben@chromium.org>
Date: Fri Dec 15 21:23:17 2017

Add a regression test for normalizing custom attributes.

A recent BoringSSL change broke this. Add a regression test for it
before I try to make the change again.

Bug:  789802 
Change-Id: Ibe021424fc6b36b2ef71d91b30f523a2cfae1482
Reviewed-on: https://chromium-review.googlesource.com/828381
Commit-Queue: Matt Mueller <mattm@chromium.org>
Reviewed-by: Matt Mueller <mattm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#524467}
[modify] https://crrev.com/c4dd10518c291c20a9881e6720d8b9a9505c2010/net/BUILD.gn
[modify] https://crrev.com/c4dd10518c291c20a9881e6720d8b9a9505c2010/net/cert/internal/verify_name_match_unittest.cc
[add] https://crrev.com/c4dd10518c291c20a9881e6720d8b9a9505c2010/net/data/verify_name_match_unittest/names/custom-custom-normalized.pem

Sign in to add a comment