New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 800282 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Dec 11
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Regression



Sign in to add a comment

CHECK failure: IsStringUTF8(string_value_) in values.cc

Project Member Reported by ClusterFuzz, Jan 9 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5741102614446080

Fuzzer: libFuzzer_net_spdy_session_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  IsStringUTF8(string_value_) in values.cc
  base::Value::Value
  base::Value::Value
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=449627:449661

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5741102614446080

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jan 9 2018

Components: Internals>Core
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: brajkumar@chromium.org
Labels: -Type-Bug M-64 Test-Predator-Wrong Type-Bug-Regression
Owner: dcheng@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.

Using Code Search for the file, "values.cc" and observed there was some recent changes for the below file.

Suspect CL: 
--------------https://chromium.googlesource.com/chromium/src/+/34ef31b4db760d0445a8de0d7a0075982aea7b61%5E%21/base/values.cc

dcheng@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!
Components: -Internals>Core Internals>Network>Logging
Owner: b...@chromium.org
This is probably the netlog code putting binary data in strings.
That's a valid hypothesis.  Could have been something like what was fixed at https://crrev.com/c/570627.  (This was unsanitized binary data received over the wire.)
This particular repro is logging headers from a PUSH_PROMISE, which contain non-UTF8 characters.

That logging comes from here:

https://chromium.googlesource.com/chromium/src/+/87bb331bd43bae02932037e48cfd6e9343122b43/net/spdy/spdy_log_util.cc#25
Project Member

Comment 6 by ClusterFuzz, Dec 1

Labels: -Reproducible Unreproducible
ClusterFuzz testcase 5741102614446080 appears to be flaky, updating reproducibility label.
Labels: -Unreproducible Reproducible
Please ignore the last comment about testcase being unreproducible. The testcase is still reproducible. This happened due to a code refactoring on ClusterFuzz side, and the underlying root cause is now fixed. Resetting the label back to Reproducible. Sorry about the inconvenience caused from these incorrect notifications.
Please ignore the last comment about testcase being unreproducible. The testcase is still reproducible. This happened due to a code refactoring on ClusterFuzz side, and the underlying root cause is now fixed. Resetting the label back to Reproducible. Sorry about the inconvenience caused from these incorrect notifications.
Project Member

Comment 9 by bugdroid1@chromium.org, Dec 7

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/66871e3ef3779595d6294e09e95cf4c59e2c7342

commit 66871e3ef3779595d6294e09e95cf4c59e2c7342
Author: Bence Béky <bnc@chromium.org>
Date: Thu Dec 06 21:11:24 2018

Change SpdyHeaderBlockNetLogCallback() dict value type.

SpdyHeaderBlockNetLogCallback() returns a base::DictionaryValue with a
single entry with key "headers".  This CL changes the value of that
entry from a base::DictionaryValue to a base::ListValue.  The motivation
is that this way duplicate code with ElideSpdyHeaderBlockForNetLog() can
be eliminated, so it will be enough to fix  https://crbug.com/800282  in
one function.

Also make sure that unittests only use base::Value methods that are not
marked as deprecated.

Bug:  800282 
Change-Id: Ie9396f7299acb84ad21892894ae5607ee8af7f34
Reviewed-on: https://chromium-review.googlesource.com/c/1362086
Reviewed-by: Eric Roman <eroman@chromium.org>
Commit-Queue: Bence Béky <bnc@chromium.org>
Cr-Commit-Position: refs/heads/master@{#614490}
[modify] https://crrev.com/66871e3ef3779595d6294e09e95cf4c59e2c7342/net/spdy/spdy_log_util.cc
[modify] https://crrev.com/66871e3ef3779595d6294e09e95cf4c59e2c7342/net/spdy/spdy_log_util_unittest.cc
[modify] https://crrev.com/66871e3ef3779595d6294e09e95cf4c59e2c7342/net/spdy/spdy_network_transaction_unittest.cc

Project Member

Comment 10 by bugdroid1@chromium.org, Dec 10

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2468c53ca1e48b9230edc5c4774254d9e964de4d

commit 2468c53ca1e48b9230edc5c4774254d9e964de4d
Author: Eric Roman <eroman@chromium.org>
Date: Mon Dec 10 19:59:59 2018

Escape non-ASCII strings sent to NetLog from ElideSpdyHeaderBlockForNetLog().

Bug:  800282 ,  657115 
Change-Id: I61ae689ad688aa5282ea0df2850aaf94894787e8
Reviewed-on: https://chromium-review.googlesource.com/c/1368646
Reviewed-by: Bence Béky <bnc@chromium.org>
Commit-Queue: Eric Roman <eroman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#615208}
[modify] https://crrev.com/2468c53ca1e48b9230edc5c4774254d9e964de4d/net/spdy/spdy_log_util.cc
[modify] https://crrev.com/2468c53ca1e48b9230edc5c4774254d9e964de4d/net/spdy/spdy_log_util_unittest.cc

Project Member

Comment 11 by ClusterFuzz, Dec 11

ClusterFuzz has detected this issue as fixed in range 615206:615211.

Detailed report: https://clusterfuzz.com/testcase?key=5741102614446080

Fuzzer: libFuzzer_net_spdy_session_fuzzer
Fuzz target binary: net_spdy_session_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  IsStringUTF8(string_value_) in values.cc
  base::Value::Value
  base::Value::Value
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=449627:449661
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=615206:615211

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5741102614446080

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 12 by ClusterFuzz, Dec 11

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5741102614446080 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment