New issue
Advanced search Search tips

Issue 844367 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Jun 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug

Blocking:
issue 62400



Sign in to add a comment

Integer-overflow in CFX_RTFBreak::AppendChar_Tab

Project Member Reported by ClusterFuzz, May 18 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5658685184147456

Fuzzer: libFuzzer_pdf_bidi_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  CFX_RTFBreak::AppendChar_Tab
  CFX_RTFBreak::AppendChar
  pdf_bidi_fuzzer.cc
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=558305:558317

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5658685184147456

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, May 18 2018

Components: Internals>Plugins>PDF
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, May 18 2018

Cc: dsinclair@chromium.org jam@chromium.org brucedaw...@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Owner: dsinclair@chromium.org
Status: Assigned (was: Untriaged)
Project Member

Comment 4 by ClusterFuzz, May 28 2018

Labels: -Reproducible Unreproducible
ClusterFuzz testcase 5658685184147456 appears to be flaky, updating reproducibility label.
Blocking: 62400
Owner: hnakashima@chromium.org
Project Member

Comment 7 by bugdroid1@chromium.org, Jun 26 2018

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/e529390fd5b521e4c223343a4b367b0ced357ed5

commit e529390fd5b521e4c223343a4b367b0ced357ed5
Author: Henrique Nakashima <hnakashima@chromium.org>
Date: Tue Jun 26 17:17:19 2018

Fix Integer-overflow in CFX_RTFBreak::AppendChar_Tab

Bug:  chromium:844367 
Change-Id: Id8185ea0219c03b4f8683362a3c2a45d481a5cfb
Reviewed-on: https://pdfium-review.googlesource.com/36170
Reviewed-by: Ryan Harrison <rharrison@chromium.org>
Commit-Queue: Henrique Nakashima <hnakashima@chromium.org>

[modify] https://crrev.com/e529390fd5b521e4c223343a4b367b0ced357ed5/xfa/fgas/layout/cfx_rtfbreak.cpp

Project Member

Comment 8 by bugdroid1@chromium.org, Jun 26 2018

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/ca386ad150be28116997b713056a4a2197c7b7e8

commit ca386ad150be28116997b713056a4a2197c7b7e8
Author: Henrique Nakashima <hnakashima@chromium.org>
Date: Tue Jun 26 19:09:39 2018

Assert that tab width assumption holds in CFX_RTFBreak.

Bug:  chromium:844367 
Change-Id: I3cbe5d97a913c734c3d54657a2fb47b30cc362fe
Reviewed-on: https://pdfium-review.googlesource.com/36191
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: Ryan Harrison <rharrison@chromium.org>

[modify] https://crrev.com/ca386ad150be28116997b713056a4a2197c7b7e8/xfa/fgas/layout/cfx_rtfbreak.cpp

Status: Fixed (was: Assigned)
Project Member

Comment 10 by bugdroid1@chromium.org, Jun 26 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a856e3247c018176370ec0bfd62a8add1b141ba5

commit a856e3247c018176370ec0bfd62a8add1b141ba5
Author: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Tue Jun 26 20:16:18 2018

Roll src/third_party/pdfium 75ee53784b5e..0a6dbeffbc61 (11 commits)

https://pdfium.googlesource.com/pdfium.git/+log/75ee53784b5e..0a6dbeffbc61


git log 75ee53784b5e..0a6dbeffbc61 --date=short --no-merges --format='%ad %ae %s'
2018-06-26 tsepez@chromium.org Add some more consts to unowned pointers.
2018-06-26 tsepez@chromium.org Use pdfium::span in CPDF_CID2UnicodeMap.
2018-06-26 hnakashima@chromium.org Fix Integer-overflow in CFX_RTFBreak::AppendChar_Tab
2018-06-26 art-snake@yandex-team.ru Simplify CPDF_Parser::RebuildCrossRef.
2018-06-26 art-snake@yandex-team.ru Unify CPDF_Document loading methods.
2018-06-26 art-snake@yandex-team.ru Add test which verify, that "Info" from linearized doc is correctly saved.
2018-06-26 art-snake@yandex-team.ru Implement CPDF_ObjStream.
2018-06-26 hnakashima@chromium.org Write pixel .evt test for dynamic_list_box_allow_multiple_selection.
2018-06-26 tsepez@chromium.org Make CPDF_Document::m_pRootDict an UnownedPtr<>.
2018-06-26 vmiklos@collabora.co.uk Add FPDFTextObj_GetFontSize() API
2018-06-26 tsepez@chromium.org Use ObservedPtr for CJS_Field::m_pJSField


Created with:
  gclient setdep -r src/third_party/pdfium@0a6dbeffbc61

The AutoRoll server is located here: https://pdfium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.



BUG= chromium:844367 , chromium:856354 
TBR=dsinclair@chromium.org

Change-Id: I53417b981430471c1a1fbb026c96004f86483522
Reviewed-on: https://chromium-review.googlesource.com/1115405
Reviewed-by: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#570511}
[modify] https://crrev.com/a856e3247c018176370ec0bfd62a8add1b141ba5/DEPS

Project Member

Comment 11 by bugdroid1@chromium.org, Jun 26 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2bb57d4d4a0d5e4aef8086b056c472226d0291ff

commit 2bb57d4d4a0d5e4aef8086b056c472226d0291ff
Author: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Tue Jun 26 22:20:20 2018

Roll src/third_party/pdfium 0a6dbeffbc61..c4dce690f433 (2 commits)

https://pdfium.googlesource.com/pdfium.git/+log/0a6dbeffbc61..c4dce690f433


git log 0a6dbeffbc61..c4dce690f433 --date=short --no-merges --format='%ad %ae %s'
2018-06-26 tsepez@chromium.org Use pdfium::span<> in cpdf_fontglobals.h
2018-06-26 hnakashima@chromium.org Assert that tab width assumption holds in CFX_RTFBreak.


Created with:
  gclient setdep -r src/third_party/pdfium@c4dce690f433

The AutoRoll server is located here: https://pdfium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.



BUG= chromium:844367 
TBR=dsinclair@chromium.org

Change-Id: I6ac929ade18a91057a923cfaa74a1f046f472b1b
Reviewed-on: https://chromium-review.googlesource.com/1115411
Reviewed-by: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#570550}
[modify] https://crrev.com/2bb57d4d4a0d5e4aef8086b056c472226d0291ff/DEPS

Sign in to add a comment