New issue
Advanced search Search tips

Issue 813738 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Feb 2018
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Ill in long base::internal::CheckOnFailure::HandleFailure<long>

Project Member Reported by ClusterFuzz, Feb 20 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5657949280927744

Fuzzer: afl_cbor_reader_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: Ill
Crash Address: 0x00000038b329
Crash State:
  long base::internal::CheckOnFailure::HandleFailure<long>
  cbor::CBORReader::ReadMapContent
  cbor::CBORReader::DecodeCompleteDataItem
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=537717:537724

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5657949280927744

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Feb 20 2018

Components: Internals
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Feb 20 2018

Labels: Test-Predator-Auto-Owner
Owner: kouhei@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/8abc3038960de43eb28bfe10cd6c058709dc9aad (CBORReader: Add CBORReader::DecodeDataItemHeader()).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Project Member

Comment 3 by bugdroid1@chromium.org, Feb 22 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1e3136289954860e760caa4214124249c9549c59

commit 1e3136289954860e760caa4214124249c9549c59
Author: Kouhei Ueno <kouhei@chromium.org>
Date: Thu Feb 22 07:37:27 2018

CBORReader: CBOR array/map length should be treated as uint64_t

Bug:  813738 ,  813735 
Change-Id: I126e260f6ffb938264a40f92a286cf8488852f56
Reviewed-on: https://chromium-review.googlesource.com/927926
Reviewed-by: Balazs Engedy <engedy@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Kouhei Ueno <kouhei@chromium.org>
Cr-Commit-Position: refs/heads/master@{#538378}
[modify] https://crrev.com/1e3136289954860e760caa4214124249c9549c59/components/cbor/cbor_reader.cc
[modify] https://crrev.com/1e3136289954860e760caa4214124249c9549c59/components/cbor/cbor_reader_unittest.cc

Project Member

Comment 4 by ClusterFuzz, Feb 23 2018

ClusterFuzz has detected this issue as fixed in range 538377:538379.

Detailed report: https://clusterfuzz.com/testcase?key=5657949280927744

Fuzzer: afl_cbor_reader_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: Ill
Crash Address: 0x00000038b329
Crash State:
  long base::internal::CheckOnFailure::HandleFailure<long>
  cbor::CBORReader::ReadMapContent
  cbor::CBORReader::DecodeCompleteDataItem
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=537717:537724
Fixed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=538377:538379

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5657949280927744

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Feb 23 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5657949280927744 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment