CHECK failure: root_element.is_none() in xml_parser.cc |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5677686331801600 Fuzzer: libFuzzer_xml_parser_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: root_element.is_none() in xml_parser.cc data_decoder::XmlParser::Parse xml_parser_fuzzer.cc Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=519803:519843 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5677686331801600 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Dec 4 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/acc25ce9edc14281e9cc87279816dfecc3e615fa commit acc25ce9edc14281e9cc87279816dfecc3e615fa Author: Jay Civelli <jcivelli@google.com> Date: Mon Dec 04 18:28:43 2017 Fixes for SafeXmlParser choking on DTD and DOCTYPE. Changing the SafeXmlParser so it ignores nodes like DTDs and processing instructions. Bug: 789838 Change-Id: I0bf4a07509309f9e7720fdcea6283542a0b489ff Reviewed-on: https://chromium-review.googlesource.com/804946 Reviewed-by: Scott Graham <scottmg@chromium.org> Reviewed-by: Robert Sesek <rsesek@chromium.org> Commit-Queue: Jay Civelli <jcivelli@chromium.org> Cr-Commit-Position: refs/heads/master@{#521392} [modify] https://crrev.com/acc25ce9edc14281e9cc87279816dfecc3e615fa/services/data_decoder/xml_parser.cc [add] https://crrev.com/acc25ce9edc14281e9cc87279816dfecc3e615fa/services/data_decoder/xml_parser_fuzzer_corpus/input10 [add] https://crrev.com/acc25ce9edc14281e9cc87279816dfecc3e615fa/services/data_decoder/xml_parser_fuzzer_corpus/input11 [add] https://crrev.com/acc25ce9edc14281e9cc87279816dfecc3e615fa/services/data_decoder/xml_parser_fuzzer_corpus/input9 [modify] https://crrev.com/acc25ce9edc14281e9cc87279816dfecc3e615fa/services/data_decoder/xml_parser_unittest.cc [modify] https://crrev.com/acc25ce9edc14281e9cc87279816dfecc3e615fa/third_party/libxml/chromium/libxml_utils.cc [modify] https://crrev.com/acc25ce9edc14281e9cc87279816dfecc3e615fa/third_party/libxml/chromium/libxml_utils.h
,
Dec 4 2017
,
Dec 5 2017
ClusterFuzz has detected this issue as fixed in range 521363:521398. Detailed report: https://clusterfuzz.com/testcase?key=5677686331801600 Fuzzer: libFuzzer_xml_parser_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: root_element.is_none() in xml_parser.cc data_decoder::XmlParser::Parse xml_parser_fuzzer.cc Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=519803:519843 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=521363:521398 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5677686331801600 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Dec 5 2017
ClusterFuzz testcase 5677686331801600 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||
►
Sign in to add a comment |
|||
Comment 1 by pnangunoori@chromium.org
, Dec 1 2017Labels: M-64
Owner: jcivelli@chromium.org
Status: Assigned (was: Untriaged)