Issue metadata
Sign in to add a comment
|
Stack-overflow in xmlParseMarkupDecl |
||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5075577299271680 Fuzzer: libFuzzer_libxml_xml_read_memory_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Stack-overflow Crash Address: 0x7fff20589d98 Crash State: xmlParseMarkupDecl xmlParseConditionalSections xmlParseConditionalSections Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=395614:395804 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5075577299271680 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Jan 10 2018
Unable to find actual suspect through code search and also from the provided CL, hence marking it as untriaged. Note: Observing some recent changes for the below file 'parser.c', so cc'ing to @joelhockey for more updates on this issue. https://chromium.googlesource.com/chromium/src/+/1932201570802d524f80c5055644bfaac65a5a86 Thanks!
,
Feb 2 2018
This fuzzer error wouldn't be caused by any recent CL. It is likely a problem which has always existed which is just now being uncovered by the fuzzer. Curiously, I can only replicate this error with debug turned on. I have now moved off chromium/libxml, so I wont be able to investigate further.
,
Mar 28 2018
ClusterFuzz has detected this issue as fixed in range 546214:546271. Detailed report: https://clusterfuzz.com/testcase?key=5075577299271680 Fuzzer: libFuzzer_libxml_xml_read_memory_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Stack-overflow Crash Address: 0x7fff20589d98 Crash State: xmlParseMarkupDecl xmlParseConditionalSections xmlParseConditionalSections Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=395614:395804 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=546214:546271 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5075577299271680 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Mar 28 2018
ClusterFuzz testcase 5075577299271680 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by ClusterFuzz
, Jan 9 2018Labels: Test-Predator-Auto-Components