Integer-overflow in CFX_RTFBreak::AppendChar_Tab |
|||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5658685184147456 Fuzzer: libFuzzer_pdf_bidi_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: CFX_RTFBreak::AppendChar_Tab CFX_RTFBreak::AppendChar pdf_bidi_fuzzer.cc Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=558305:558317 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5658685184147456 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
May 18 2018
Automatically adding ccs based on OWNERS file / target commit history. If this is incorrect, please add ClusterFuzz-Wrong label.
,
May 18 2018
,
May 28 2018
ClusterFuzz testcase 5658685184147456 appears to be flaky, updating reproducibility label.
,
Jun 12 2018
,
Jun 25 2018
,
Jun 26 2018
The following revision refers to this bug: https://pdfium.googlesource.com/pdfium/+/e529390fd5b521e4c223343a4b367b0ced357ed5 commit e529390fd5b521e4c223343a4b367b0ced357ed5 Author: Henrique Nakashima <hnakashima@chromium.org> Date: Tue Jun 26 17:17:19 2018 Fix Integer-overflow in CFX_RTFBreak::AppendChar_Tab Bug: chromium:844367 Change-Id: Id8185ea0219c03b4f8683362a3c2a45d481a5cfb Reviewed-on: https://pdfium-review.googlesource.com/36170 Reviewed-by: Ryan Harrison <rharrison@chromium.org> Commit-Queue: Henrique Nakashima <hnakashima@chromium.org> [modify] https://crrev.com/e529390fd5b521e4c223343a4b367b0ced357ed5/xfa/fgas/layout/cfx_rtfbreak.cpp
,
Jun 26 2018
The following revision refers to this bug: https://pdfium.googlesource.com/pdfium/+/ca386ad150be28116997b713056a4a2197c7b7e8 commit ca386ad150be28116997b713056a4a2197c7b7e8 Author: Henrique Nakashima <hnakashima@chromium.org> Date: Tue Jun 26 19:09:39 2018 Assert that tab width assumption holds in CFX_RTFBreak. Bug: chromium:844367 Change-Id: I3cbe5d97a913c734c3d54657a2fb47b30cc362fe Reviewed-on: https://pdfium-review.googlesource.com/36191 Commit-Queue: Ryan Harrison <rharrison@chromium.org> Reviewed-by: Ryan Harrison <rharrison@chromium.org> [modify] https://crrev.com/ca386ad150be28116997b713056a4a2197c7b7e8/xfa/fgas/layout/cfx_rtfbreak.cpp
,
Jun 26 2018
,
Jun 26 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/a856e3247c018176370ec0bfd62a8add1b141ba5 commit a856e3247c018176370ec0bfd62a8add1b141ba5 Author: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Date: Tue Jun 26 20:16:18 2018 Roll src/third_party/pdfium 75ee53784b5e..0a6dbeffbc61 (11 commits) https://pdfium.googlesource.com/pdfium.git/+log/75ee53784b5e..0a6dbeffbc61 git log 75ee53784b5e..0a6dbeffbc61 --date=short --no-merges --format='%ad %ae %s' 2018-06-26 tsepez@chromium.org Add some more consts to unowned pointers. 2018-06-26 tsepez@chromium.org Use pdfium::span in CPDF_CID2UnicodeMap. 2018-06-26 hnakashima@chromium.org Fix Integer-overflow in CFX_RTFBreak::AppendChar_Tab 2018-06-26 art-snake@yandex-team.ru Simplify CPDF_Parser::RebuildCrossRef. 2018-06-26 art-snake@yandex-team.ru Unify CPDF_Document loading methods. 2018-06-26 art-snake@yandex-team.ru Add test which verify, that "Info" from linearized doc is correctly saved. 2018-06-26 art-snake@yandex-team.ru Implement CPDF_ObjStream. 2018-06-26 hnakashima@chromium.org Write pixel .evt test for dynamic_list_box_allow_multiple_selection. 2018-06-26 tsepez@chromium.org Make CPDF_Document::m_pRootDict an UnownedPtr<>. 2018-06-26 vmiklos@collabora.co.uk Add FPDFTextObj_GetFontSize() API 2018-06-26 tsepez@chromium.org Use ObservedPtr for CJS_Field::m_pJSField Created with: gclient setdep -r src/third_party/pdfium@0a6dbeffbc61 The AutoRoll server is located here: https://pdfium-roll.skia.org Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. BUG= chromium:844367 , chromium:856354 TBR=dsinclair@chromium.org Change-Id: I53417b981430471c1a1fbb026c96004f86483522 Reviewed-on: https://chromium-review.googlesource.com/1115405 Reviewed-by: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Commit-Queue: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#570511} [modify] https://crrev.com/a856e3247c018176370ec0bfd62a8add1b141ba5/DEPS
,
Jun 26 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/2bb57d4d4a0d5e4aef8086b056c472226d0291ff commit 2bb57d4d4a0d5e4aef8086b056c472226d0291ff Author: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Date: Tue Jun 26 22:20:20 2018 Roll src/third_party/pdfium 0a6dbeffbc61..c4dce690f433 (2 commits) https://pdfium.googlesource.com/pdfium.git/+log/0a6dbeffbc61..c4dce690f433 git log 0a6dbeffbc61..c4dce690f433 --date=short --no-merges --format='%ad %ae %s' 2018-06-26 tsepez@chromium.org Use pdfium::span<> in cpdf_fontglobals.h 2018-06-26 hnakashima@chromium.org Assert that tab width assumption holds in CFX_RTFBreak. Created with: gclient setdep -r src/third_party/pdfium@c4dce690f433 The AutoRoll server is located here: https://pdfium-roll.skia.org Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. BUG= chromium:844367 TBR=dsinclair@chromium.org Change-Id: I6ac929ade18a91057a923cfaa74a1f046f472b1b Reviewed-on: https://chromium-review.googlesource.com/1115411 Reviewed-by: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Commit-Queue: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#570550} [modify] https://crrev.com/2bb57d4d4a0d5e4aef8086b056c472226d0291ff/DEPS |
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by ClusterFuzz
, May 18 2018Labels: Test-Predator-Auto-Components