New issue
Advanced search Search tips

Issue 869719 link

Starred by 1 user

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 3
Type: Bug-Regression



Sign in to add a comment

Bad-cast to std::__1::locale::__imp from std::__1::locale::__imp in base::LoadNativeLibraryWithOptions

Project Member Reported by ClusterFuzz, Aug 1

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6436829516267520

Fuzzer: libFuzzer_gpu_raster_angle_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0x7f1c0b5f65b0
Crash State:
  Bad-cast to std::__1::locale::__imp from std::__1::locale::__imp
  base::LoadNativeLibraryWithOptions
  base::LoadNativeLibrary
  
Sanitizer: undefined (UBSAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=579136:579142

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6436829516267520

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Aug 1

Components: Internals>Core Internals>GPU>Internals
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by sheriffbot@chromium.org, Aug 1

Labels: M-69 Target-69
Project Member

Comment 3 by sheriffbot@chromium.org, Aug 1

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 4 by sheriffbot@chromium.org, Aug 1

Labels: Pri-1
Project Member

Comment 5 by sheriffbot@chromium.org, Aug 2

Labels: -Security_Impact-Head Security_Impact-Beta
Owner: thomasanderson@chromium.org
Status: Assigned (was: Untriaged)
Introduced by https://chromium-review.googlesource.com/c/chromium/src/+/1153978

Seem to be the same issue as  issue 867762  which was introduced by https://chromium-review.googlesource.com/1119098 and then fixed by https://chromium-review.googlesource.com/1151917
M69 Stable promotion is coming VERY soon. Your bug is labelled as Stable ReleaseBlock, pls make sure to land the fix and request a merge into the release branch ASAP. Thank you.
Cc: awhalley@chromium.org
+awhalley@ (Security TPM), this is M69 stable blocker and M69 stable release is coming very soon. PTAL. Thank you.
Labels: -Type-Bug-Security -Pri-1 -Restrict-View-SecurityTeam -Security_Severity-High -Security_Impact-Beta -ReleaseBlock-Stable -Target-69 Pri-3 Type-Bug-Regression
Removing release block and security restrictions.  This is not a real bad-cast.  It's just an issue with our tooling not deduplicating the typeinfo for that particular type in the standard library.  This is seen in the error message:
"Bad-cast to std::__1::locale::__imp from std::__1::locale::__imp".  As you can see, the types are the same.
Project Member

Comment 10 by ClusterFuzz, Dec 12

ClusterFuzz has detected this issue as fixed in range 615699:615711.

Detailed report: https://clusterfuzz.com/testcase?key=6436829516267520

Fuzzer: libFuzzer_gpu_raster_angle_fuzzer
Fuzz target binary: gpu_raster_angle_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0x7f1c0b5f65b0
Crash State:
  Bad-cast to std::__1::locale::__imp from std::__1::locale::__imp
  base::LoadNativeLibraryWithOptions
  base::LoadNativeLibrary
  
Sanitizer: undefined (UBSAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=579136:579142
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=615699:615711

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6436829516267520

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by ClusterFuzz, Dec 12

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6436829516267520 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Status: Assigned (was: Verified)

Sign in to add a comment