New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 827826 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Regression



Sign in to add a comment

Crash in Execute$1b5b4d74f2b6cc593f836dd5164b9587.cfi

Project Member Reported by ClusterFuzz, Mar 31 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4875000893669376

Fuzzer: inferno_webbot
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 
Crash State:
  Execute$1b5b4d74f2b6cc593f836dd5164b9587.cfi
  VP8EncAnalyze.cfi
  WebPEncode.cfi
  
Sanitizer: cfi (CFI)

Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=546919:546953

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4875000893669376

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Cc: brajkumar@chromium.org
Components: Blink
Labels: -Type-Bug M-67 Test-Predator-Wrong CF-NeedsTriage Type-Bug-Regression
Unable to find actual suspect through code search and also observing no related changes under regression range, hence adding appropriate label and requesting someone from blink team to look in to this issue.

Thanks!

Labels: -CF-NeedsTriage
Owner: vtsyrklevich@chromium.org
Hello, this is due to a recent change to the CFI build that enabled cfi-icall checking. This code in libwebp was not hit by the regular unit tests but is hit by ClusterFuzz. I'm preparing a fix now.
Project Member

Comment 4 by bugdroid1@chromium.org, Apr 2 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/webm/libwebp/+/978eec2507e3b5110bd1d2a408fa27a8f7e702cf

commit 978eec2507e3b5110bd1d2a408fa27a8f7e702cf
Author: Vlad Tsyrklevich <vtsyrklevich@chromium.org>
Date: Mon Apr 02 23:04:47 2018

[CFI] Remove function pointer casts

Control Flow Integrity [1] indirect call checking verifies that function
pointers only call valid functions with a matching type signature. This
change eliminates function pointer casts that were causing cfi-icall
failures.

[1] https://www.chromium.org/developers/testing/control-flow-integrity

BUG= chromium:827826 

Change-Id: I5db021d06390a6cefd670fdd2f0d34c9e530465e

[modify] https://crrev.com/978eec2507e3b5110bd1d2a408fa27a8f7e702cf/src/enc/alpha_enc.c
[modify] https://crrev.com/978eec2507e3b5110bd1d2a408fa27a8f7e702cf/src/enc/vp8l_enc.c
[modify] https://crrev.com/978eec2507e3b5110bd1d2a408fa27a8f7e702cf/src/enc/analysis_enc.c
[modify] https://crrev.com/978eec2507e3b5110bd1d2a408fa27a8f7e702cf/src/dec/frame_dec.c

Project Member

Comment 5 by bugdroid1@chromium.org, Apr 3 2018

Labels: merge-merged-1.0.0
The following revision refers to this bug:
  https://chromium.googlesource.com/webm/libwebp/+/38410c082fe2879f02cb60840b5fe8347c78e46b

commit 38410c082fe2879f02cb60840b5fe8347c78e46b
Author: Vlad Tsyrklevich <vtsyrklevich@chromium.org>
Date: Mon Apr 02 23:57:14 2018

[CFI] Remove function pointer casts

Control Flow Integrity [1] indirect call checking verifies that function
pointers only call valid functions with a matching type signature. This
change eliminates function pointer casts that were causing cfi-icall
failures.

[1] https://www.chromium.org/developers/testing/control-flow-integrity

BUG= chromium:827826 

Change-Id: I5db021d06390a6cefd670fdd2f0d34c9e530465e
(cherry picked from commit 978eec2507e3b5110bd1d2a408fa27a8f7e702cf)

[modify] https://crrev.com/38410c082fe2879f02cb60840b5fe8347c78e46b/src/enc/alpha_enc.c
[modify] https://crrev.com/38410c082fe2879f02cb60840b5fe8347c78e46b/src/enc/vp8l_enc.c
[modify] https://crrev.com/38410c082fe2879f02cb60840b5fe8347c78e46b/src/enc/analysis_enc.c
[modify] https://crrev.com/38410c082fe2879f02cb60840b5fe8347c78e46b/src/dec/frame_dec.c

Comment 6 by junov@chromium.org, Apr 3 2018

Components: -Blink Internals>Media>Codecs
Project Member

Comment 8 by ClusterFuzz, Apr 10 2018

ClusterFuzz has detected this issue as fixed in range 547798:549174.

Detailed report: https://clusterfuzz.com/testcase?key=4875000893669376

Fuzzer: inferno_webbot
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 
Crash State:
  Execute$1b5b4d74f2b6cc593f836dd5164b9587.cfi
  VP8EncAnalyze.cfi
  WebPEncode.cfi
  
Sanitizer: cfi (CFI)

Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=546919:546953
Fixed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=547798:549174

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4875000893669376

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Apr 10 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 4875000893669376 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment