New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 860067 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Jul 4
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Undefined-shift in zucchini::BufferSource::GetSleb128

Project Member Reported by ClusterFuzz, Jul 3

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4696006634242048

Fuzzer: libFuzzer_zucchini_disassembler_dex_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  zucchini::BufferSource::GetSleb128
  zucchini::CodeItemParser::GetNext
  zucchini::DisassemblerDex::ParseHeader
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=572200:572205

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4696006634242048

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jul 3

Components: Internals>Installer>Diff
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jul 3

Cc: ckitagawa@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 3 by ClusterFuzz, Jul 3

Labels: Test-Predator-Auto-Owner
Owner: ckitagawa@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/c2a778621cbcd812e2687269ba3f10132a31df12 ([Zucchini] Add dissassembler_dex Fuzzer).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Project Member

Comment 4 by bugdroid1@chromium.org, Jul 4

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d550e67840653dd68f49cdab0e58ca7268359bb9

commit d550e67840653dd68f49cdab0e58ca7268359bb9
Author: Calder Kitagawa <ckitagawa@chromium.org>
Date: Wed Jul 04 15:29:58 2018

[Zucchini] Fix undefined shift in GetSleb128.

A left shift resulting in truncation is undefined behavior on signed
int types in C++. It is fine to left shift an unsigned type because
there is no issues with two's complement representation or sign bits.
To get around this we need to perform the shift on the uint type and
recast it to a signed int type.

Bug:  860067 
Change-Id: Ibace5aceb17c4435d6d37d5e37a16fa781c7dd99
Reviewed-on: https://chromium-review.googlesource.com/1126169
Reviewed-by: Samuel Huang <huangs@chromium.org>
Commit-Queue: Calder Kitagawa <ckitagawa@chromium.org>
Cr-Commit-Position: refs/heads/master@{#572577}
[modify] https://crrev.com/d550e67840653dd68f49cdab0e58ca7268359bb9/components/zucchini/buffer_source.cc

Status: Fixed (was: Assigned)
Project Member

Comment 6 by ClusterFuzz, Jul 5

ClusterFuzz has detected this issue as fixed in range 572576:572579.

Detailed report: https://clusterfuzz.com/testcase?key=4696006634242048

Fuzzer: libFuzzer_zucchini_disassembler_dex_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  zucchini::BufferSource::GetSleb128
  zucchini::CodeItemParser::GetNext
  zucchini::DisassemblerDex::ParseHeader
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=572200:572205
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=572576:572579

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4696006634242048

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Jul 5

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 4696006634242048 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment