New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 789832 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Dec 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: IsStringUTF8(string_value_) in values.cc

Project Member Reported by ClusterFuzz, Nov 30 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5521412067688448

Fuzzer: libFuzzer_xml_parser_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  IsStringUTF8(string_value_) in values.cc
  base::Value::Value
  base::Value::Value
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=519803:519843

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5521412067688448

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 30 2017

Components: Internals>Core
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: msrchandra@chromium.org pnangunoori@chromium.org
Labels: M-64
Owner: jcivelli@chromium.org
Status: Assigned (was: Untriaged)
Test Predator has given the following results:

Adding a SafeXMLParser to the data-decoder service. by jcivelli@google.com
Suspected changelist touched the crashing line in xml_parser.cc
Suspected changelist touched file(s) in the directory services/data_decoder, which appears in the stack trace.
Suspected changelist touched files xml_parser.cc, xml_parser_fuzzer.cc, which appear in the stack trace.

@jcivelli -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes.

Thank You.
Project Member

Comment 3 by bugdroid1@chromium.org, Dec 5 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9fa6de06cbbf5b49375a5d8f20b1b8aa6278f568

commit 9fa6de06cbbf5b49375a5d8f20b1b8aa6278f568
Author: Jay Civelli <jcivelli@google.com>
Date: Tue Dec 05 01:33:19 2017

Making SafeXmlParser fail on invalid UTF8 text.

SafeXmlParser would DCHECK with CData containing non UTF8 strings. Now
validating that the text is valid UTF8 and failing gracefully if it's
not.

Bug:  789832 
Change-Id: I6cae6d1fad4297563627d2168c726160095be0d0
Reviewed-on: https://chromium-review.googlesource.com/805001
Commit-Queue: Jay Civelli <jcivelli@chromium.org>
Reviewed-by: Chris Palmer <palmer@chromium.org>
Reviewed-by: Adam Rice <ricea@chromium.org>
Cr-Commit-Position: refs/heads/master@{#521579}
[modify] https://crrev.com/9fa6de06cbbf5b49375a5d8f20b1b8aa6278f568/services/data_decoder/xml_parser.cc
[modify] https://crrev.com/9fa6de06cbbf5b49375a5d8f20b1b8aa6278f568/services/data_decoder/xml_parser_unittest.cc

Status: Fixed (was: Assigned)
Project Member

Comment 5 by ClusterFuzz, Dec 5 2017

ClusterFuzz has detected this issue as fixed in range 521545:521584.

Detailed report: https://clusterfuzz.com/testcase?key=5521412067688448

Fuzzer: libFuzzer_xml_parser_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  IsStringUTF8(string_value_) in values.cc
  base::Value::Value
  base::Value::Value
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=519803:519843
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=521545:521584

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5521412067688448

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Dec 5 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 5521412067688448 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment