New issue
Advanced search Search tips

Issue 828069 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in opj_setup_decoder.cfi

Project Member Reported by ClusterFuzz, Apr 2 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6580715949654016

Fuzzer: ochang_search_index_mutator
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 
Crash State:
  opj_setup_decoder.cfi
  CJPX_Decoder::Init
  CCodec_JpxModule::CreateDecoder
  
Sanitizer: cfi (CFI)

Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=546919:546953

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6580715949654016

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Apr 2 2018

Components: Internals>Plugins>PDF
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Apr 2 2018

Labels: Test-Predator-Auto-Owner
Owner: thomasanderson@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://pdfium.googlesource.com/pdfium/+/8f4f0ede809a9bae283538f5c6930c5d7ba13585 (Fix use_custom_libcxx=false build on Linux).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Labels: Test-Predator-Wrong
Owner: thestig@chromium.org
That CL just added some missing #includes.  Over to thestig
Cc: npm@chromium.org p...@chromium.org
pcc: Any advice on what we can do to fix the CFI issue in libopenjpeg?
Note: It's easier to reproduce the error by building pdfium_test with CFI enabled from a Chromium checkout.

Comment 6 by p...@chromium.org, Apr 2 2018

Cc: vtsyrklevich@chromium.org
This seems to be related to vtsyrklevicxh's change to enable cfi-icall on the CF bot: https://chromium-review.googlesource.com/985155
libopenjpeg20 appears to use pointer casts, the following pdfium CL should enable type generalization for that library and fix this specific issue: https://pdfium-review.googlesource.com/#/c/pdfium/+/29570

Please tag me in any other CFI errors that you see crop up.
Cc: thestig@chromium.org
Owner: vtsyrklevich@chromium.org
Project Member

Comment 9 by bugdroid1@chromium.org, Apr 3 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/243267c7004bcc503724333df44fa0c773838c74

commit 243267c7004bcc503724333df44fa0c773838c74
Author: pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Tue Apr 03 02:12:50 2018

Roll src/third_party/pdfium/ 399806702..75304f915 (1 commit)

https://pdfium.googlesource.com/pdfium.git/+log/3998067026e9..75304f915c5c

$ git log 399806702..75304f915 --date=short --no-merges --format='%ad %ae %s'
2018-04-02 vtsyrklevich Enable cfi-icall type generalization for libopenjpeg20

Created with:
  roll-dep src/third_party/pdfium
BUG= chromium:828069 


The AutoRoll server is located here: https://pdfium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


TBR=dsinclair@chromium.org

Change-Id: Ia02df952b5fd29a6567cfac2aa3f6c9f52776b64
Reviewed-on: https://chromium-review.googlesource.com/991055
Reviewed-by: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#547603}
[modify] https://crrev.com/243267c7004bcc503724333df44fa0c773838c74/DEPS

Project Member

Comment 10 by ClusterFuzz, Apr 4 2018

ClusterFuzz has detected this issue as fixed in range 547597:547614.

Detailed report: https://clusterfuzz.com/testcase?key=6580715949654016

Fuzzer: ochang_search_index_mutator
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 
Crash State:
  opj_setup_decoder.cfi
  CJPX_Decoder::Init
  CCodec_JpxModule::CreateDecoder
  
Sanitizer: cfi (CFI)

Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=546919:546953
Fixed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=547597:547614

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6580715949654016

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by ClusterFuzz, Apr 4 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6580715949654016 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 12 by ClusterFuzz, Apr 4 2018

ClusterFuzz has detected this issue as fixed in range 547597:547614.

Detailed report: https://clusterfuzz.com/testcase?key=6580715949654016

Fuzzer: ochang_search_index_mutator
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 
Crash State:
  opj_setup_decoder.cfi
  CJPX_Decoder::Init
  CCodec_JpxModule::CreateDecoder
  
Sanitizer: cfi (CFI)

Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=546919:546953
Fixed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=547597:547614

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6580715949654016

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment