Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://pdfium.googlesource.com/pdfium/+/80a6cbe0a427e155de8555bc867af745d10f9777 (Return pdfium::span<char> from ByteString::GetBuffer().).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

 Issue 832568  has been merged into this issue.

 Issue 832822  has been merged into this issue.

Sure feels like underflow in src_size - 2, sigh, I am stoooooooooooopid.

   if (bstr[i] == '#' && i < src_size - 2) 

CL at https://pdfium-review.googlesource.com/c/pdfium/+/30790

Even better, revert at https://pdfium-review.googlesource.com/c/pdfium/+/30792 . Will reland post-branch.

 Issue 832992  has been merged into this issue.

 Issue 833062  has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d2a1cd60416172d8372a9c9343e01e227d2321ee

commit d2a1cd60416172d8372a9c9343e01e227d2321ee
Author: pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Tue Apr 17 03:03:46 2018

Roll src/third_party/pdfium/ d5624a47b..6b26e1ae6 (24 commits)

https://pdfium.googlesource.com/pdfium.git/+log/d5624a47bcaa..6b26e1ae6932

$ git log d5624a47b..6b26e1ae6 --date=short --no-merges --format='%ad %ae %s'
2018-04-16 hnakashima Remove non-const CPDF_PageObjectHolder::GetPageObjectList().
2018-04-16 dsinclair Merge CFX_XMLElement and CFX_XMLAttributeNode
2018-04-16 tsepez Write out StringViewTemplate::Operator=().
2018-04-16 tsepez Revert "Return pdfium::span<wchar_t> from WideString::GetBuffer()."
2018-04-16 dsinclair Split GetNumbericSymbol into individual methods
2018-04-16 hnakashima Add test for saving after adding or removing page objects.
2018-04-16 thestig Fix some checks for FX_Realloc() failures.
2018-04-16 npm Simplify CFX_DIBitmap::TransferBitmap
2018-04-16 thestig Consolidate Black/Whitepoint parsing code CPDF_ColorSpace.
2018-04-16 dsinclair Remove CXML
2018-04-16 tsepez Put prototypes of PDF_NameEncode/Decode in fpdf_parser_utility.h
2018-04-16 thestig Consolidate BlackPoint parsing code in CPDF_ColorSpace.
2018-04-16 thestig Add Black/WhitePoint array constant in CPDF_ColorSpace.
2018-04-16 thestig More CPDF_Colorspace cleanup.
2018-04-16 hnakashima Update AUTHORS.
2018-04-16 dsinclair Convert CXFA_XMLLocale to CFX_XML
2018-04-16 dsinclair Add CXFA_XMLLocale unittests
2018-04-16 npm Check that CFX_DIBitmap::Create calls succeeds in fpdf_view
2018-04-16 dsinclair Move CXML to be XFA only
2018-04-16 tsepez Revert "Return pdfium::span<char> from ByteString::GetBuffer()."
2018-04-16 thestig Fix some nits in CPDF_ColorSpace.
2018-04-16 thestig Fix a comment in CPDF_PatternCS.
2018-04-16 dsinclair Remove CPWL_Edit rich text support
2018-04-16 dsinclair Use CFX_XML instead of CXML in CPDF_Metadata

Created with:
  roll-dep src/third_party/pdfium
BUG= chromium:832557 , chromium:832978 , chromium:832992 , chromium:833062 , chromium:833097 


The AutoRoll server is located here: https://pdfium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


TBR=dsinclair@chromium.org

Change-Id: I0362765b3919b2f1aa5ba1f50774f5176083a4fd
Reviewed-on: https://chromium-review.googlesource.com/1014474
Reviewed-by: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#551217}
[modify] https://crrev.com/d2a1cd60416172d8372a9c9343e01e227d2321ee/DEPS

This bug requires manual review: DEPS changes referenced in bugdroid comments.
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), kbleicher@(ChromeOS), govind@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

ClusterFuzz has detected this issue as fixed in range 551207:551217.

Detailed report: https://clusterfuzz.com/testcase?key=4592279940235264

Fuzzer: libFuzzer_pdf_streamparser_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x053900000887
Crash State:
  pdfium::span<unsigned char const>::operator
  PDF_NameDecode
  CPDF_StreamParser::ReadNextObject
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=550360:550379
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=551207:551217

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4592279940235264

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4592279940235264 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Is this merge request for CL listed at #12? If yes, how is the change listed at #12 looking in canary? And is it safe to merge?

It's reverted via 4e636b74000b0c97be28ccc52fa1f2a5bb8c80ca (HEAD, origin/chromium/3396) in the PDFium repository.  

All the code that tripped these paths was rolled back to a known safe version.
Trunk has had the code fixed and rolled forward.

 tsepez@, Sorry, I'm confused.  Is cl listed at #18 got merged to M67 without approval?

No, the approval was granted on https://bugs.chromium.org/p/chromium/issues/detail?id=833173.  Once that change hit, this issue becomes moot.

In other words, no, the CL in #12 was not merged to the branch.  Instead a rollback of two cls was created for 833173, which also prevents the introduction of this issue.

Got it, thank you. 

Assuming nothing is pending for M67, removing "Merge-Review-67" label. 

Issue 780433 has been merged into this issue.