New issue
Advanced search Search tips

Issue 836661 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 1
Type: Bug



Sign in to add a comment

Ill in unsigned long pdfium::base::CheckOnFailure::HandleFailure<unsigned long>

Project Member Reported by ClusterFuzz, Apr 25 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5105274843824128

Fuzzer: libFuzzer_pdf_xml_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Ill
Crash Address: 0x0000024fe4e9
Crash State:
  unsigned long pdfium::base::CheckOnFailure::HandleFailure<unsigned long>
  pdfium::base::internal::StrictNumeric<unsigned long> pdfium::base::internal::Che
  fxcrt::StringDataTemplate<wchar_t>::Create
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=553218:553273

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5105274843824128

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Apr 25 2018

Components: Internals>Plugins>PDF
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Owner: dsinclair@chromium.org
CFX_XMLParser -> dsinclair.
Project Member

Comment 3 by ClusterFuzz, Apr 25 2018

Labels: OS-Mac
Cc: dsinclair@chromium.org
 Issue 836750  has been merged into this issue.
 Issue 836745  has been merged into this issue.
Status: Started (was: Untriaged)
Project Member

Comment 7 by bugdroid1@chromium.org, Apr 26 2018

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/52ab95aa3edbabbe90dcefcc54f3b6dace7ac53d

commit 52ab95aa3edbabbe90dcefcc54f3b6dace7ac53d
Author: Dan Sinclair <dsinclair@chromium.org>
Date: Thu Apr 26 20:20:37 2018

Reset entity start when clearing text

When we extract the text data we need to make sure we clear any
entity start positions, otherwise our entity extraction will go badly.

Bug:  chromium:836661 
Change-Id: Icbafdef912b1f5b495eafef426961c5df66cd3fd
Reviewed-on: https://pdfium-review.googlesource.com/31450
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>

[modify] https://crrev.com/52ab95aa3edbabbe90dcefcc54f3b6dace7ac53d/core/fxcrt/xml/cfx_xmlparser.cpp
[modify] https://crrev.com/52ab95aa3edbabbe90dcefcc54f3b6dace7ac53d/core/fxcrt/xml/cfx_xmlparser_unittest.cpp

Status: Fixed (was: Started)
Project Member

Comment 9 by bugdroid1@chromium.org, Apr 27 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7953f3b0dbadc80a3cfab5e16bcef23eec838cd4

commit 7953f3b0dbadc80a3cfab5e16bcef23eec838cd4
Author: pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Fri Apr 27 00:42:27 2018

Roll src/third_party/pdfium/ 789a227a6..52ab95aa3 (5 commits)

https://pdfium.googlesource.com/pdfium.git/+log/789a227a635b..52ab95aa3edb

$ git log 789a227a6..52ab95aa3 --date=short --no-merges --format='%ad %ae %s'
2018-04-26 dsinclair Reset entity start when clearing text
2018-04-26 hnakashima Fix caret moving to next line upon click on line break in XFA edit.
2018-04-26 tsepez Replace some c-style cast with static_cast<>
2018-04-26 hnakashima Enter key inserts a line break correctly in XFA edits.
2018-04-26 hnakashima Improve diffing and regeneration of expected pngs.

Created with:
  roll-dep src/third_party/pdfium
BUG= chromium:836661 , chromium:836361 , chromium:836361 


The AutoRoll server is located here: https://pdfium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


TBR=dsinclair@chromium.org

Change-Id: Ieeae5930c87aaac8c7f6ac258d9e9a1f8002d1ac
Reviewed-on: https://chromium-review.googlesource.com/1031555
Commit-Queue: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Reviewed-by: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#554226}
[modify] https://crrev.com/7953f3b0dbadc80a3cfab5e16bcef23eec838cd4/DEPS

Project Member

Comment 10 by ClusterFuzz, Apr 27 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 5448467963707392 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 11 by ClusterFuzz, Apr 27 2018

ClusterFuzz has detected this issue as fixed in range 554222:554246.

Detailed report: https://clusterfuzz.com/testcase?key=5105274843824128

Fuzzer: libFuzzer_pdf_xml_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Ill
Crash Address: 0x0000024fe4e9
Crash State:
  unsigned long pdfium::base::CheckOnFailure::HandleFailure<unsigned long>
  pdfium::base::internal::StrictNumeric<unsigned long> pdfium::base::internal::Che
  fxcrt::StringDataTemplate<wchar_t>::Create
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=553218:553273
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=554222:554246

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5105274843824128

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment