Null-dereference READ in sh::TParseContext::checkIsBelowStructNestingLimit |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4757259086462976 Fuzzer: libFuzzer_angle_translator_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: sh::TParseContext::checkIsBelowStructNestingLimit sh::TParseContext::addStructDeclaratorList yyparse Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=525054:525064 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4757259086462976 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Dec 22 2017
,
Dec 26 2017
,
Dec 27 2017
Fix here: https://chromium-review.googlesource.com/c/angle/angle/+/842643 - just needs code review.
,
Dec 28 2017
The following revision refers to this bug: https://chromium.googlesource.com/angle/angle/+/f095799b54ea62f37b6af4e272c535b92562ea6d commit f095799b54ea62f37b6af4e272c535b92562ea6d Author: Olli Etuaho <oetuaho@nvidia.com> Date: Thu Dec 28 17:55:02 2017 Fix accessing the name of a nested struct definition When generating an error message about the struct nesting limit, the code should make sure that the struct definitions are not nested. While nested struct definitions by themselves are also an error, they're not a syntax error so parsing will continue after encountering them. This fixes a regression from commit: Don't allocate name strings for empty symbols. BUG= chromium:797156 TEST=angle_unittests Change-Id: I4149fbe874c0e7ec90e690aec078ccaf7313eab0 Reviewed-on: https://chromium-review.googlesource.com/842643 Commit-Queue: Olli Etuaho <oetuaho@nvidia.com> Reviewed-by: Jamie Madill <jmadill@chromium.org> [modify] https://crrev.com/f095799b54ea62f37b6af4e272c535b92562ea6d/src/compiler/translator/ParseContext.cpp [modify] https://crrev.com/f095799b54ea62f37b6af4e272c535b92562ea6d/src/tests/compiler_tests/ShaderValidation_test.cpp
,
Dec 28 2017
The following revision refers to this bug: https://skia.googlesource.com/skia/+/570592a3e058dc6f9e020782c98c80d254eda951 commit 570592a3e058dc6f9e020782c98c80d254eda951 Author: angle-deps-roller@chromium.org <angle-deps-roller@chromium.org> Date: Thu Dec 28 18:33:30 2017 Roll skia/third_party/externals/angle2/ aaa55bfa3..f095799b5 (1 commit) https://chromium.googlesource.com/angle/angle.git/+log/aaa55bfa376d..f095799b54ea $ git log aaa55bfa3..f095799b5 --date=short --no-merges --format='%ad %ae %s' 2017-12-22 oetuaho Fix accessing the name of a nested struct definition Created with: roll-dep skia/third_party/externals/angle2 BUG= 797156 The AutoRoll server is located here: https://angle-skia-roll.skia.org Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. CQ_INCLUDE_TRYBOTS=skia.primary:Perf-Win10-Clang-AlphaR2-GPU-RadeonR9M470X-x86_64-Debug-All-ANGLE,Perf-Win10-Clang-NUC5i7RYH-GPU-IntelIris6100-x86_64-Debug-All-ANGLE,Perf-Win10-Clang-NUC6i5SYK-GPU-IntelIris540-x86_64-Debug-All-ANGLE,Perf-Win10-Clang-NUCD34010WYKH-GPU-IntelHD4400-x86_64-Debug-All-ANGLE,Perf-Win10-Clang-ShuttleC-GPU-GTX960-x86_64-Debug-All-ANGLE,Test-Win10-Clang-AlphaR2-GPU-RadeonR9M470X-x86_64-Debug-All-ANGLE,Test-Win10-Clang-NUC6i5SYK-GPU-IntelIris540-x86_64-Debug-All-ANGLE,Test-Win10-Clang-NUCD34010WYKH-GPU-IntelHD4400-x86_64-Debug-All-ANGLE,Test-Win10-Clang-ShuttleC-GPU-GTX960-x86_64-Debug-All-ANGLE,Build-Debian9-Clang-x86_64-Release-ANGLE TBR=kjlubick@google.com Change-Id: Ia1cc3afadffaa2fd56ab4b316d053e629508317e Reviewed-on: https://skia-review.googlesource.com/89760 Commit-Queue: angle-deps-roller . <angle-deps-roller@chromium.org> Reviewed-by: angle-deps-roller . <angle-deps-roller@chromium.org> [modify] https://crrev.com/570592a3e058dc6f9e020782c98c80d254eda951/DEPS
,
Dec 28 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/1d358273781cd1834d1fe11e8a760b3364131a2d commit 1d358273781cd1834d1fe11e8a760b3364131a2d Author: angle-deps-roller@chromium.org <angle-deps-roller@chromium.org> Date: Thu Dec 28 19:42:13 2017 Roll src/third_party/angle/ aaa55bfa3..f095799b5 (1 commit) https://chromium.googlesource.com/angle/angle.git/+log/aaa55bfa376d..f095799b54ea $ git log aaa55bfa3..f095799b5 --date=short --no-merges --format='%ad %ae %s' 2017-12-22 oetuaho Fix accessing the name of a nested struct definition Created with: roll-dep src/third_party/angle BUG= 797156 The AutoRoll server is located here: https://angle-chromium-roll.skia.org Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel TBR=fjhenigman@chromium.org Change-Id: I50c6d4d8758b97f2b9ac2ed2918c33ce7a7dbd0b Reviewed-on: https://chromium-review.googlesource.com/845862 Commit-Queue: angle-deps-roller . <angle-deps-roller@chromium.org> Reviewed-by: angle-deps-roller . <angle-deps-roller@chromium.org> Cr-Commit-Position: refs/heads/master@{#526315} [modify] https://crrev.com/1d358273781cd1834d1fe11e8a760b3364131a2d/DEPS
,
Dec 28 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/facd0c0e27a5a5ab78e10000f2d26f76a0b4e57b commit facd0c0e27a5a5ab78e10000f2d26f76a0b4e57b Author: skia-deps-roller@chromium.org <skia-deps-roller@chromium.org> Date: Thu Dec 28 19:47:40 2017 Roll src/third_party/skia/ fa8bc34f2..570592a3e (1 commit) https://skia.googlesource.com/skia.git/+log/fa8bc34f2884..570592a3e058 $ git log fa8bc34f2..570592a3e --date=short --no-merges --format='%ad %ae %s' 2017-12-28 angle-deps-roller Roll skia/third_party/externals/angle2/ aaa55bfa3..f095799b5 (1 commit) Created with: roll-dep src/third_party/skia BUG= 797156 The AutoRoll server is located here: https://autoroll.skia.org Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel TBR=kjlubick@chromium.org Change-Id: Ic458718e72496fed39ffc91dde8ede06e0023790 Reviewed-on: https://chromium-review.googlesource.com/845899 Reviewed-by: Skia Deps Roller <skia-deps-roller@chromium.org> Commit-Queue: Skia Deps Roller <skia-deps-roller@chromium.org> Cr-Commit-Position: refs/heads/master@{#526317} [modify] https://crrev.com/facd0c0e27a5a5ab78e10000f2d26f76a0b4e57b/DEPS
,
Dec 29 2017
ClusterFuzz testcase 5682576504389632 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Dec 29 2017
ClusterFuzz has detected this issue as fixed in range 526314:526321. Detailed report: https://clusterfuzz.com/testcase?key=4757259086462976 Fuzzer: libFuzzer_angle_translator_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: sh::TParseContext::checkIsBelowStructNestingLimit sh::TParseContext::addStructDeclaratorList yyparse Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=525054:525064 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=526314:526321 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4757259086462976 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
|||
►
Sign in to add a comment |
|||
Comment 1 by ClusterFuzz
, Dec 22 2017Owner: oetu...@nvidia.com
Status: Assigned (was: Untriaged)