New issue
Advanced search Search tips

Issue 807863 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Feb 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug

Blocking:
issue 62400



Sign in to add a comment

Indirect-leak in CXFA_Node::CreateXMLMappingNode

Project Member Reported by ClusterFuzz, Feb 1 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4968420517609472

Fuzzer: libFuzzer_pdfium_xfa_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Indirect-leak
Crash Address: 
Crash State:
  CXFA_Node::CreateXMLMappingNode
  MaybeCreateDataNode
  UpdateBindingRelations
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=459132:459191

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4968420517609472

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Feb 1 2018

Components: Internals>Plugins>PDF
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Feb 1 2018

Cc: dsinclair@chromium.org
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Add XFA pdfium fuzzer by dsinclair@chromium.org - https://chromium.googlesource.com/chromium/src/+/034ca9381180401b9b25eac088babf7fdae847d8

Cleanup some xfa/fxfa code. by dsinclair@chromium.org - https://pdfium.googlesource.com/pdfium/+/80c487809858b74783a00e05cc8164edf4b1307c

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Blocking: 62400
XFA, not enabled on any branch of Chrome.
Labels: -Pri-1 Pri-2
Owner: dsinclair@chromium.org
Status: Unconfirmed (was: Untriaged)
Project Member

Comment 5 by bugdroid1@chromium.org, Feb 6 2018

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/6556be05e041e97b29eae8166c60eb83af7f5bd2

commit 6556be05e041e97b29eae8166c60eb83af7f5bd2
Author: Dan Sinclair <dsinclair@chromium.org>
Date: Tue Feb 06 18:31:48 2018

Make the CXFA_Node parent pointer Unowned

This CL converts the CXFA_Node parent pointer to be an Unowned pointer
instead of a raw pointer.

Bug:  chromium:807863 
Change-Id: I266c9216cfe8153e234bf66b88fbac6c8d96ebb4
Reviewed-on: https://pdfium-review.googlesource.com/25650
Reviewed-by: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>

[modify] https://crrev.com/6556be05e041e97b29eae8166c60eb83af7f5bd2/xfa/fxfa/parser/cxfa_node.cpp
[modify] https://crrev.com/6556be05e041e97b29eae8166c60eb83af7f5bd2/xfa/fxfa/parser/cxfa_node.h

Cc: -dsinclair@chromium.org
Status: Started (was: Unconfirmed)
This should be fixed with https://pdfium-review.googlesource.com/c/pdfium/+/26790
Status: Fixed (was: Started)
Project Member

Comment 9 by bugdroid1@chromium.org, Feb 14 2018

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/7c04794d145d9d5c679dcd33d0ebcef662dcc909

commit 7c04794d145d9d5c679dcd33d0ebcef662dcc909
Author: Dan Sinclair <dsinclair@chromium.org>
Date: Wed Feb 14 16:22:29 2018

Set node to owning element

When the document creates anew data root element it assigns it into the
CXFA_Node but fails to set that node as owing the XML node. The XML node
is never inserted into another XML tree so it ends up being leaked.

This CL sets the CXFA_Node to own the XML data tree node so it will be
cleaned up properly.

Bug:  chromium:807863 
Change-Id: I72a1b8f7b1f1a50bf7139d8bd0ecc8e504ccfc91
Reviewed-on: https://pdfium-review.googlesource.com/26790
Reviewed-by: Ryan Harrison <rharrison@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>

[modify] https://crrev.com/7c04794d145d9d5c679dcd33d0ebcef662dcc909/xfa/fxfa/parser/xfa_document_datamerger_imp.cpp

Cc: rharrison@chromium.org dsinclair@chromium.org
 Issue 799688  has been merged into this issue.

Sign in to add a comment