New issue
Advanced search Search tips

Issue 869171 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Aug 2
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

ASSERT: false

Project Member Reported by ClusterFuzz, Jul 30

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4844900055777280

Fuzzer: libFuzzer_pdfium_xfa_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  false
  CPDF_Object::MakeReference
  CBA_FontMap::AddFontToAnnotDict
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=576839:576840

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4844900055777280

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jul 30

Components: Internals>Plugins>PDF
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jul 30

Cc: art-sn...@yandex-team.ru
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Rework of CPDF_Parser::RebuildCrossRef. by art-snake@yandex-team.ru - https://pdfium.googlesource.com/pdfium/+/c68109a2dac3be544b7753d1fd677255d859745b

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Cc: pnangunoori@chromium.org
Labels: M-70
Owner: thestig@chromium.org
Status: Assigned (was: Untriaged)
Test Predator has given the following results:

Rework of CPDF_Parser::RebuildCrossRef. by art-snake@yandex-team.ru

Suspected changelist touched file(s) in the directory core/fpdfapi/parser, which appears in the stack trace.
Suspected changelist touched file(s) associated with the component Internals>Plugins>PDF, which we believe is related to this testcase based on information in OWNERS files.

Assigning to thestig@ as we are not able to assign the issue to art-snake@
thestig@  -- Could you please look into this issue as you are the reviewer of the commint, kindly reassign if it has nothing to do with this changes.

Thank You.
Project Member

Comment 4 by bugdroid1@chromium.org, Aug 2

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/20e6688ab462d7ef749c1f97b83b5f325e88f698

commit 20e6688ab462d7ef749c1f97b83b5f325e88f698
Author: Lei Zhang <thestig@chromium.org>
Date: Thu Aug 02 19:44:33 2018

Handle inline font dicts in CBA_FontMap::AddFontToAnnotDict().

BUG= chromium:869171 

Change-Id: I0176bcafa8a63396d916916b5e10b96573085d04
Reviewed-on: https://pdfium-review.googlesource.com/39414
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>

[modify] https://crrev.com/20e6688ab462d7ef749c1f97b83b5f325e88f698/fpdfsdk/formfiller/cba_fontmap.cpp

Status: Fixed (was: Assigned)
Project Member

Comment 6 by bugdroid1@chromium.org, Aug 3

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0fcb16c4acfd2bf90979fb48fb2fdd26812c67e8

commit 0fcb16c4acfd2bf90979fb48fb2fdd26812c67e8
Author: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Fri Aug 03 00:41:42 2018

Roll src/third_party/pdfium 8ed949d3dcdc..95340100f95f (5 commits)

https://pdfium.googlesource.com/pdfium.git/+log/8ed949d3dcdc..95340100f95f


git log 8ed949d3dcdc..95340100f95f --date=short --no-merges --format='%ad %ae %s'
2018-08-02 tsepez@chromium.org Tidy JBig2_Image.cpp
2018-08-02 thestig@chromium.org Handle inline font dicts in CBA_FontMap::AddFontToAnnotDict().
2018-08-02 art-snake@yandex-team.ru Rework of CPDF_DataAvail::CheckHintTables.
2018-08-02 thestig@chromium.org Remove -Wno-pointer-to-int-cast from fxcodec target.
2018-08-02 tsepez@chromium.org Introduce JBIG2_PUTDWORD() macro in CJBIG2_Image.h


Created with:
  gclient setdep -r src/third_party/pdfium@95340100f95f

The AutoRoll server is located here: https://pdfium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.



BUG= chromium:869171 
TBR=dsinclair@chromium.org

Change-Id: I3aa3c1f6538a4a6e238352c313d36a74fc4625d7
Reviewed-on: https://chromium-review.googlesource.com/1161144
Reviewed-by: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#580393}
[modify] https://crrev.com/0fcb16c4acfd2bf90979fb48fb2fdd26812c67e8/DEPS

Project Member

Comment 7 by ClusterFuzz, Aug 3

ClusterFuzz has detected this issue as fixed in range 580391:580395.

Detailed report: https://clusterfuzz.com/testcase?key=4844900055777280

Fuzzer: libFuzzer_pdfium_xfa_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  false
  CPDF_Object::MakeReference
  CBA_FontMap::AddFontToAnnotDict
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=576839:576840
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=580391:580395

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4844900055777280

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Aug 3

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 4844900055777280 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment