Crash in opj_setup_decoder.cfi |
|||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6580715949654016 Fuzzer: ochang_search_index_mutator Job Type: linux_cfi_chrome Platform Id: linux Crash Type: UNKNOWN Crash Address: Crash State: opj_setup_decoder.cfi CJPX_Decoder::Init CCodec_JpxModule::CreateDecoder Sanitizer: cfi (CFI) Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=546919:546953 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6580715949654016 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Apr 2 2018
Automatically assigning owner based on suspected regression changelist https://pdfium.googlesource.com/pdfium/+/8f4f0ede809a9bae283538f5c6930c5d7ba13585 (Fix use_custom_libcxx=false build on Linux). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Apr 2 2018
That CL just added some missing #includes. Over to thestig
,
Apr 2 2018
pcc: Any advice on what we can do to fix the CFI issue in libopenjpeg?
,
Apr 2 2018
Note: It's easier to reproduce the error by building pdfium_test with CFI enabled from a Chromium checkout.
,
Apr 2 2018
This seems to be related to vtsyrklevicxh's change to enable cfi-icall on the CF bot: https://chromium-review.googlesource.com/985155
,
Apr 2 2018
libopenjpeg20 appears to use pointer casts, the following pdfium CL should enable type generalization for that library and fix this specific issue: https://pdfium-review.googlesource.com/#/c/pdfium/+/29570 Please tag me in any other CFI errors that you see crop up.
,
Apr 2 2018
,
Apr 3 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/243267c7004bcc503724333df44fa0c773838c74 commit 243267c7004bcc503724333df44fa0c773838c74 Author: pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Date: Tue Apr 03 02:12:50 2018 Roll src/third_party/pdfium/ 399806702..75304f915 (1 commit) https://pdfium.googlesource.com/pdfium.git/+log/3998067026e9..75304f915c5c $ git log 399806702..75304f915 --date=short --no-merges --format='%ad %ae %s' 2018-04-02 vtsyrklevich Enable cfi-icall type generalization for libopenjpeg20 Created with: roll-dep src/third_party/pdfium BUG= chromium:828069 The AutoRoll server is located here: https://pdfium-roll.skia.org Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. TBR=dsinclair@chromium.org Change-Id: Ia02df952b5fd29a6567cfac2aa3f6c9f52776b64 Reviewed-on: https://chromium-review.googlesource.com/991055 Reviewed-by: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Commit-Queue: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#547603} [modify] https://crrev.com/243267c7004bcc503724333df44fa0c773838c74/DEPS
,
Apr 4 2018
ClusterFuzz has detected this issue as fixed in range 547597:547614. Detailed report: https://clusterfuzz.com/testcase?key=6580715949654016 Fuzzer: ochang_search_index_mutator Job Type: linux_cfi_chrome Platform Id: linux Crash Type: UNKNOWN Crash Address: Crash State: opj_setup_decoder.cfi CJPX_Decoder::Init CCodec_JpxModule::CreateDecoder Sanitizer: cfi (CFI) Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=546919:546953 Fixed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=547597:547614 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6580715949654016 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Apr 4 2018
ClusterFuzz testcase 6580715949654016 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Apr 4 2018
ClusterFuzz has detected this issue as fixed in range 547597:547614. Detailed report: https://clusterfuzz.com/testcase?key=6580715949654016 Fuzzer: ochang_search_index_mutator Job Type: linux_cfi_chrome Platform Id: linux Crash Type: UNKNOWN Crash Address: Crash State: opj_setup_decoder.cfi CJPX_Decoder::Init CCodec_JpxModule::CreateDecoder Sanitizer: cfi (CFI) Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=546919:546953 Fixed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=547597:547614 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6580715949654016 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by ClusterFuzz
, Apr 2 2018Labels: Test-Predator-Auto-Components