Undefined-shift in CJBig2_HuffmanDecoder::DecodeAValue |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6645917462298624 Fuzzer: libFuzzer_pdf_codec_jbig2_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Undefined-shift Crash Address: Crash State: CJBig2_HuffmanDecoder::DecodeAValue CJBig2_SDDProc::DecodeHuffman CJBig2_Context::ParseSymbolDict Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=554549:554567 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6645917462298624 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Apr 29 2018
Automatically adding ccs based on OWNERS file / target commit history. If this is incorrect, please add ClusterFuzz-Wrong label.
,
Apr 29 2018
Automatically assigning owner based on suspected regression changelist https://pdfium.googlesource.com/pdfium/+/724f61671bec82f521be75b0ace069fb3130902a (Change CJBig2_HuffmanTable to use struct JBig2HuffmanCode.). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
May 2 2018
The following revision refers to this bug: https://pdfium.googlesource.com/pdfium/+/28cad1534619d55820593baed0b6d6f3cbf767eb commit 28cad1534619d55820593baed0b6d6f3cbf767eb Author: Lei Zhang <thestig@chromium.org> Date: Wed May 02 14:33:54 2018 Make several Huffman decoders consistently check for integer overflows. BUG= chromium:837972 Change-Id: I6cfa28bff38870419e4b1e2bced427cfcbf843cd Reviewed-on: https://pdfium-review.googlesource.com/31912 Commit-Queue: Ryan Harrison <rharrison@chromium.org> Reviewed-by: Ryan Harrison <rharrison@chromium.org> [modify] https://crrev.com/28cad1534619d55820593baed0b6d6f3cbf767eb/core/fxcodec/jbig2/JBig2_HuffmanDecoder.cpp [modify] https://crrev.com/28cad1534619d55820593baed0b6d6f3cbf767eb/core/fxcodec/jbig2/JBig2_Context.cpp [modify] https://crrev.com/28cad1534619d55820593baed0b6d6f3cbf767eb/core/fxcodec/jbig2/JBig2_TrdProc.cpp
,
May 2 2018
,
May 2 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/ad8e5171e8f690cb17cd8ec3bff9528cb3fcab3c commit ad8e5171e8f690cb17cd8ec3bff9528cb3fcab3c Author: pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Date: Wed May 02 18:25:15 2018 Roll src/third_party/pdfium/ 5f3e4f160..d3b0f7cc7 (3 commits) https://pdfium.googlesource.com/pdfium.git/+log/5f3e4f1605a5..d3b0f7cc78e6 $ git log 5f3e4f160..d3b0f7cc7 --date=short --no-merges --format='%ad %ae %s' 2018-05-02 hnakashima Remove int out params from reference to pointer in CXFA_Node. 2018-05-02 thestig Make several Huffman decoders consistently check for integer overflows. 2018-05-02 tsepez Remove unused cpdfxfa_context.h includes from unittests Created with: roll-dep src/third_party/pdfium BUG= chromium:837972 The AutoRoll server is located here: https://pdfium-roll.skia.org Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. TBR=dsinclair@chromium.org Change-Id: Id94199a352df2125f5afc40d50475f73fd7b6aa6 Reviewed-on: https://chromium-review.googlesource.com/1039776 Reviewed-by: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Commit-Queue: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#555475} [modify] https://crrev.com/ad8e5171e8f690cb17cd8ec3bff9528cb3fcab3c/DEPS
,
May 3 2018
ClusterFuzz has detected this issue as fixed in range 555457:555478. Detailed report: https://clusterfuzz.com/testcase?key=6645917462298624 Fuzzer: libFuzzer_pdf_codec_jbig2_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Undefined-shift Crash Address: Crash State: CJBig2_HuffmanDecoder::DecodeAValue CJBig2_SDDProc::DecodeHuffman CJBig2_Context::ParseSymbolDict Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=554549:554567 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=555457:555478 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6645917462298624 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
May 3 2018
ClusterFuzz testcase 6645917462298624 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, Apr 29 2018Labels: Test-Predator-Auto-Components