Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://pdfium.googlesource.com/pdfium/+/3faa382d4feb3c272333f20e16106a5bbc472990 (Decrease XML parser buffer size).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

 Issue 837582  has been merged into this issue.

 Issue 837579  has been merged into this issue.

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/70180648ffd01dd3716871758411d2031aaaebbe

commit 70180648ffd01dd3716871758411d2031aaaebbe
Author: Dan Sinclair <dsinclair@chromium.org>
Date: Wed May 02 16:02:03 2018

Add a CFX_XMLDocument class.

This CL adds a CFX_XMLDocument to act as the XML node container. All
nodes are now owned by the document and the document is returned by the
CFX_XMLParser.

Classes which parse XML files now store the document instead of the root
node.

BUG:  chromium:835636 
Change-Id: I1e07d6115cf14714911d6fd4c3fa920c94fd5faf
Reviewed-on: https://pdfium-review.googlesource.com/31313
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>

[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fxcrt/xml/cfx_xmlnode.h
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fxcrt/xml/cfx_xmlelement.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/xfa/fxfa/parser/cxfa_document_parser.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/xfa/fxfa/parser/cxfa_document.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fxcrt/xml/cfx_xmlinstruction.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/xfa/fxfa/parser/cxfa_document_parser_unittest.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/fxjs/xfa/cjx_packet.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fxcrt/xml/cfx_xmlparser.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fxcrt/xml/cfx_xmlinstruction.h
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fxcrt/xml/cfx_xmltext.h
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fxcrt/xml/cfx_xmlnode_unittest.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fxcrt/xml/cfx_xmlchardata_unittest.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/xfa/fxfa/parser/cxfa_nodeowner.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fxcrt/xml/cfx_xmlelement_unittest.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fxcrt/xml/cfx_xmlelement.h
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/fxjs/xfa/cjx_node.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fxcrt/xml/cfx_xmltext_unittest.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fxcrt/xml/cfx_xmlparser.h
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fxcrt/xml/cfx_xmlchardata.h
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fxcrt/xml/cfx_xmlchardata.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fxcrt/xml/cfx_xmlparser_unittest.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/xfa/fxfa/parser/cxfa_nodeowner.h
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/xfa/fxfa/cxfa_ffdoc.h
[add] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fxcrt/xml/cfx_xmldocument_unittest.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/BUILD.gn
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fpdfdoc/cpdf_metadata.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fxcrt/xml/cfx_xmlinstruction_unittest.cpp
[add] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fxcrt/xml/cfx_xmldocument.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/xfa/fxfa/parser/cxfa_document_parser.h
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fxcrt/xml/cfx_xmltext.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/xfa/fxfa/parser/cxfa_xmllocale.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/xfa/fxfa/parser/cxfa_node.h
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/testing/libfuzzer/pdf_xml_fuzzer.cc
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/xfa/fxfa/parser/cxfa_node.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/xfa/fxfa/cxfa_ffdoc.cpp
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/xfa/fxfa/parser/cxfa_xmllocale.h
[modify] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fxcrt/xml/cfx_xmlnode.cpp
[add] https://crrev.com/70180648ffd01dd3716871758411d2031aaaebbe/core/fxcrt/xml/cfx_xmldocument.h

ClusterFuzz has detected this issue as fixed in range 555527:555561.

Detailed report: https://clusterfuzz.com/testcase?key=4708343160242176

Fuzzer: libFuzzer_pdf_xml_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Stack-overflow
Crash Address: 0x7ffd5d0d8ff8
Crash State:
  CFX_XMLElement::~CFX_XMLElement
  CFX_XMLNode::~CFX_XMLNode
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=548157:548177
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=555527:555561

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4708343160242176

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4708343160242176 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

 Issue 834222  has been merged into this issue.

 Issue 832603  has been merged into this issue.

 Issue 831464  has been merged into this issue.

 Issue 798697  has been merged into this issue.