Automatically applying components based on crash stacktrace and information from OWNERS files.
If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Hmm.... So, we do use "ucnv_UTF8FromUTF8" in libxml. Last week, I cherry-picked an upstream fix for that function. Let me try a test case in this bug and see if it's fixed by the cherry-pick.
Hmm.... bug 603496 has the top of the stack identical to this one (except for ICU version #), but I can't reproduce it in the ToT while I can reproduce this one.
Maybe, it's not a dupe.
Anyway, the ubsan complained about this:
third_party/icu/source/common/ucnv_u8.cpp:784:29: runtime error: left shift of negative value -175623977
line 784: c=(c<<6)+b;
|c| is of type UChar32 (unsigned int32). I wonder why ubsan thinks that it is -175623977. BTW, its absolute value is much smaller than 2^31 (let alone 2^32).
The test case this sequence at the end:
f3 a0 81 81 97 99
The first 4 bytes stand for U+E0041 and the last two bytes are invalid.
Let me try to reproduce the bug outside libxml with the above sequence.
Markus and Joel had an offline conversation about libxml's use of ICU converter. There was a similar bug ( bug 722420 ) which was due to libxml's misuse of ICU converter API. That one was fixed by fixing libxml.
Joel wrote:
-------------
I can reproduce this. I'm pretty sure the bug is with libxml setting flush when it shouldn't just like the last fuzzer bug.
I'm pretty sure it is this line setting flush to true when it should be false.
https://cs.chromium.org/chromium/src/third_party/libxml/src/xmlIO.c?l=3160&rcl=493a404fb9a975817a8c8962225380219e82ae40
I'm trying to create a testcase and fix for libxml but it is taking a little while.
-----------------
I'm giving this to him.
I confirmed Joel's hunch. Changing the line in comment 14 made UBSan happy. libxml emitted an encoding error on the invalid UTF-8 sequence in question.
ClusterFuzz testcase 6424257411416064 is verified as fixed, so closing issue as verified.
If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Comment 1 by ClusterFuzz
, Dec 1 2017Labels: Test-Predator-Auto-Components