New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 797156 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Email to this user bounced
Closed: Dec 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in sh::TParseContext::checkIsBelowStructNestingLimit

Project Member Reported by ClusterFuzz, Dec 22 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4757259086462976

Fuzzer: libFuzzer_angle_translator_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  sh::TParseContext::checkIsBelowStructNestingLimit
  sh::TParseContext::addStructDeclaratorList
  yyparse
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=525054:525064

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4757259086462976

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Dec 22 2017

Labels: Test-Predator-Auto-Owner
Owner: oetu...@nvidia.com
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/angle/angle/+/ae4dbf32ba112c767d6e67d6e5734fc81d8c2d8c (Don't allocate name strings for empty symbols).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

Comment 2 by oetu...@nvidia.com, Dec 22 2017

Cc: pnangunoori@chromium.org oetu...@nvidia.com
 Issue 796822  has been merged into this issue.
Cc: kkaluri@chromium.org
 Issue 797276  has been merged into this issue.

Comment 4 by oetu...@nvidia.com, Dec 27 2017

Status: Started (was: Assigned)
Fix here: https://chromium-review.googlesource.com/c/angle/angle/+/842643 - just needs code review.
Project Member

Comment 5 by bugdroid1@chromium.org, Dec 28 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/angle/angle/+/f095799b54ea62f37b6af4e272c535b92562ea6d

commit f095799b54ea62f37b6af4e272c535b92562ea6d
Author: Olli Etuaho <oetuaho@nvidia.com>
Date: Thu Dec 28 17:55:02 2017

Fix accessing the name of a nested struct definition

When generating an error message about the struct nesting limit, the
code should make sure that the struct definitions are not nested.
While nested struct definitions by themselves are also an error,
they're not a syntax error so parsing will continue after encountering
them.

This fixes a regression from commit: Don't allocate name strings for
empty symbols.

BUG= chromium:797156 
TEST=angle_unittests

Change-Id: I4149fbe874c0e7ec90e690aec078ccaf7313eab0
Reviewed-on: https://chromium-review.googlesource.com/842643
Commit-Queue: Olli Etuaho <oetuaho@nvidia.com>
Reviewed-by: Jamie Madill <jmadill@chromium.org>

[modify] https://crrev.com/f095799b54ea62f37b6af4e272c535b92562ea6d/src/compiler/translator/ParseContext.cpp
[modify] https://crrev.com/f095799b54ea62f37b6af4e272c535b92562ea6d/src/tests/compiler_tests/ShaderValidation_test.cpp

Project Member

Comment 6 by bugdroid1@chromium.org, Dec 28 2017

The following revision refers to this bug:
  https://skia.googlesource.com/skia/+/570592a3e058dc6f9e020782c98c80d254eda951

commit 570592a3e058dc6f9e020782c98c80d254eda951
Author: angle-deps-roller@chromium.org <angle-deps-roller@chromium.org>
Date: Thu Dec 28 18:33:30 2017

Roll skia/third_party/externals/angle2/ aaa55bfa3..f095799b5 (1 commit)

https://chromium.googlesource.com/angle/angle.git/+log/aaa55bfa376d..f095799b54ea

$ git log aaa55bfa3..f095799b5 --date=short --no-merges --format='%ad %ae %s'
2017-12-22 oetuaho Fix accessing the name of a nested struct definition

Created with:
  roll-dep skia/third_party/externals/angle2
BUG= 797156 


The AutoRoll server is located here: https://angle-skia-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


CQ_INCLUDE_TRYBOTS=skia.primary:Perf-Win10-Clang-AlphaR2-GPU-RadeonR9M470X-x86_64-Debug-All-ANGLE,Perf-Win10-Clang-NUC5i7RYH-GPU-IntelIris6100-x86_64-Debug-All-ANGLE,Perf-Win10-Clang-NUC6i5SYK-GPU-IntelIris540-x86_64-Debug-All-ANGLE,Perf-Win10-Clang-NUCD34010WYKH-GPU-IntelHD4400-x86_64-Debug-All-ANGLE,Perf-Win10-Clang-ShuttleC-GPU-GTX960-x86_64-Debug-All-ANGLE,Test-Win10-Clang-AlphaR2-GPU-RadeonR9M470X-x86_64-Debug-All-ANGLE,Test-Win10-Clang-NUC6i5SYK-GPU-IntelIris540-x86_64-Debug-All-ANGLE,Test-Win10-Clang-NUCD34010WYKH-GPU-IntelHD4400-x86_64-Debug-All-ANGLE,Test-Win10-Clang-ShuttleC-GPU-GTX960-x86_64-Debug-All-ANGLE,Build-Debian9-Clang-x86_64-Release-ANGLE
TBR=kjlubick@google.com

Change-Id: Ia1cc3afadffaa2fd56ab4b316d053e629508317e
Reviewed-on: https://skia-review.googlesource.com/89760
Commit-Queue: angle-deps-roller . <angle-deps-roller@chromium.org>
Reviewed-by: angle-deps-roller . <angle-deps-roller@chromium.org>

[modify] https://crrev.com/570592a3e058dc6f9e020782c98c80d254eda951/DEPS

Project Member

Comment 7 by bugdroid1@chromium.org, Dec 28 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1d358273781cd1834d1fe11e8a760b3364131a2d

commit 1d358273781cd1834d1fe11e8a760b3364131a2d
Author: angle-deps-roller@chromium.org <angle-deps-roller@chromium.org>
Date: Thu Dec 28 19:42:13 2017

Roll src/third_party/angle/ aaa55bfa3..f095799b5 (1 commit)

https://chromium.googlesource.com/angle/angle.git/+log/aaa55bfa376d..f095799b54ea

$ git log aaa55bfa3..f095799b5 --date=short --no-merges --format='%ad %ae %s'
2017-12-22 oetuaho Fix accessing the name of a nested struct definition

Created with:
  roll-dep src/third_party/angle
BUG= 797156 


The AutoRoll server is located here: https://angle-chromium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
TBR=fjhenigman@chromium.org

Change-Id: I50c6d4d8758b97f2b9ac2ed2918c33ce7a7dbd0b
Reviewed-on: https://chromium-review.googlesource.com/845862
Commit-Queue: angle-deps-roller . <angle-deps-roller@chromium.org>
Reviewed-by: angle-deps-roller . <angle-deps-roller@chromium.org>
Cr-Commit-Position: refs/heads/master@{#526315}
[modify] https://crrev.com/1d358273781cd1834d1fe11e8a760b3364131a2d/DEPS

Project Member

Comment 8 by bugdroid1@chromium.org, Dec 28 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/facd0c0e27a5a5ab78e10000f2d26f76a0b4e57b

commit facd0c0e27a5a5ab78e10000f2d26f76a0b4e57b
Author: skia-deps-roller@chromium.org <skia-deps-roller@chromium.org>
Date: Thu Dec 28 19:47:40 2017

Roll src/third_party/skia/ fa8bc34f2..570592a3e (1 commit)

https://skia.googlesource.com/skia.git/+log/fa8bc34f2884..570592a3e058

$ git log fa8bc34f2..570592a3e --date=short --no-merges --format='%ad %ae %s'
2017-12-28 angle-deps-roller Roll skia/third_party/externals/angle2/ aaa55bfa3..f095799b5 (1 commit)

Created with:
  roll-dep src/third_party/skia
BUG= 797156 


The AutoRoll server is located here: https://autoroll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
TBR=kjlubick@chromium.org

Change-Id: Ic458718e72496fed39ffc91dde8ede06e0023790
Reviewed-on: https://chromium-review.googlesource.com/845899
Reviewed-by: Skia Deps Roller <skia-deps-roller@chromium.org>
Commit-Queue: Skia Deps Roller <skia-deps-roller@chromium.org>
Cr-Commit-Position: refs/heads/master@{#526317}
[modify] https://crrev.com/facd0c0e27a5a5ab78e10000f2d26f76a0b4e57b/DEPS

Project Member

Comment 9 by ClusterFuzz, Dec 29 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 5682576504389632 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 10 by ClusterFuzz, Dec 29 2017

ClusterFuzz has detected this issue as fixed in range 526314:526321.

Detailed report: https://clusterfuzz.com/testcase?key=4757259086462976

Fuzzer: libFuzzer_angle_translator_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  sh::TParseContext::checkIsBelowStructNestingLimit
  sh::TParseContext::addStructDeclaratorList
  yyparse
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=525054:525064
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=526314:526321

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4757259086462976

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment