Issue metadata
Sign in to add a comment
|
Crash in Execute$1b5b4d74f2b6cc593f836dd5164b9587.cfi |
||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4875000893669376 Fuzzer: inferno_webbot Job Type: linux_cfi_chrome Platform Id: linux Crash Type: UNKNOWN Crash Address: Crash State: Execute$1b5b4d74f2b6cc593f836dd5164b9587.cfi VP8EncAnalyze.cfi WebPEncode.cfi Sanitizer: cfi (CFI) Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=546919:546953 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4875000893669376 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Apr 2 2018
Hello, this is due to a recent change to the CFI build that enabled cfi-icall checking. This code in libwebp was not hit by the regular unit tests but is hit by ClusterFuzz. I'm preparing a fix now.
,
Apr 2 2018
,
Apr 2 2018
The following revision refers to this bug: https://chromium.googlesource.com/webm/libwebp/+/978eec2507e3b5110bd1d2a408fa27a8f7e702cf commit 978eec2507e3b5110bd1d2a408fa27a8f7e702cf Author: Vlad Tsyrklevich <vtsyrklevich@chromium.org> Date: Mon Apr 02 23:04:47 2018 [CFI] Remove function pointer casts Control Flow Integrity [1] indirect call checking verifies that function pointers only call valid functions with a matching type signature. This change eliminates function pointer casts that were causing cfi-icall failures. [1] https://www.chromium.org/developers/testing/control-flow-integrity BUG= chromium:827826 Change-Id: I5db021d06390a6cefd670fdd2f0d34c9e530465e [modify] https://crrev.com/978eec2507e3b5110bd1d2a408fa27a8f7e702cf/src/enc/alpha_enc.c [modify] https://crrev.com/978eec2507e3b5110bd1d2a408fa27a8f7e702cf/src/enc/vp8l_enc.c [modify] https://crrev.com/978eec2507e3b5110bd1d2a408fa27a8f7e702cf/src/enc/analysis_enc.c [modify] https://crrev.com/978eec2507e3b5110bd1d2a408fa27a8f7e702cf/src/dec/frame_dec.c
,
Apr 3 2018
The following revision refers to this bug: https://chromium.googlesource.com/webm/libwebp/+/38410c082fe2879f02cb60840b5fe8347c78e46b commit 38410c082fe2879f02cb60840b5fe8347c78e46b Author: Vlad Tsyrklevich <vtsyrklevich@chromium.org> Date: Mon Apr 02 23:57:14 2018 [CFI] Remove function pointer casts Control Flow Integrity [1] indirect call checking verifies that function pointers only call valid functions with a matching type signature. This change eliminates function pointer casts that were causing cfi-icall failures. [1] https://www.chromium.org/developers/testing/control-flow-integrity BUG= chromium:827826 Change-Id: I5db021d06390a6cefd670fdd2f0d34c9e530465e (cherry picked from commit 978eec2507e3b5110bd1d2a408fa27a8f7e702cf) [modify] https://crrev.com/38410c082fe2879f02cb60840b5fe8347c78e46b/src/enc/alpha_enc.c [modify] https://crrev.com/38410c082fe2879f02cb60840b5fe8347c78e46b/src/enc/vp8l_enc.c [modify] https://crrev.com/38410c082fe2879f02cb60840b5fe8347c78e46b/src/enc/analysis_enc.c [modify] https://crrev.com/38410c082fe2879f02cb60840b5fe8347c78e46b/src/dec/frame_dec.c
,
Apr 3 2018
,
Apr 4 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/9a2e56d309666af45a844d9b6eb7465729c6ab41 commit 9a2e56d309666af45a844d9b6eb7465729c6ab41 Author: Vlad Tsyrklevich <vtsyrklevich@chromium.org> Date: Wed Apr 04 22:53:09 2018 libwebp: cherry-pick upstream commit 978eec25 BUG= 827826 Change-Id: I6b91c4a9691f19df11f39a0799df5d5a4703681f Reviewed-on: https://chromium-review.googlesource.com/996251 Reviewed-by: James Zern <jzern@google.com> Commit-Queue: Peter Collingbourne <pcc@chromium.org> Cr-Commit-Position: refs/heads/master@{#548226} [modify] https://crrev.com/9a2e56d309666af45a844d9b6eb7465729c6ab41/third_party/libwebp/README.chromium [modify] https://crrev.com/9a2e56d309666af45a844d9b6eb7465729c6ab41/third_party/libwebp/src/dec/frame_dec.c [modify] https://crrev.com/9a2e56d309666af45a844d9b6eb7465729c6ab41/third_party/libwebp/src/enc/alpha_enc.c [modify] https://crrev.com/9a2e56d309666af45a844d9b6eb7465729c6ab41/third_party/libwebp/src/enc/analysis_enc.c [modify] https://crrev.com/9a2e56d309666af45a844d9b6eb7465729c6ab41/third_party/libwebp/src/enc/vp8l_enc.c
,
Apr 10 2018
ClusterFuzz has detected this issue as fixed in range 547798:549174. Detailed report: https://clusterfuzz.com/testcase?key=4875000893669376 Fuzzer: inferno_webbot Job Type: linux_cfi_chrome Platform Id: linux Crash Type: UNKNOWN Crash Address: Crash State: Execute$1b5b4d74f2b6cc593f836dd5164b9587.cfi VP8EncAnalyze.cfi WebPEncode.cfi Sanitizer: cfi (CFI) Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=546919:546953 Fixed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=547798:549174 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4875000893669376 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Apr 10 2018
ClusterFuzz testcase 4875000893669376 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by brajkumar@chromium.org
, Apr 2 2018Components: Blink
Labels: -Type-Bug M-67 Test-Predator-Wrong CF-NeedsTriage Type-Bug-Regression