Null-dereference READ in spvtools::val::Function::AddFunctionCallTarget |
||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5405305811501056 Fuzzer: afl_spvtools_val_fuzzer Job Type: afl_chrome_asan Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: spvtools::val::Function::AddFunctionCallTarget spvtools::val::ValidationState_t::AddFunctionCallTarget spvtools::val::ProcessInstruction Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=579912:579914 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5405305811501056 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Aug 2
Predator and CL could not provide any possible suspects. Using the code search for the file, “validation_state.h and function.h” assigning to owner concerned from GIT blame. Suspecting Commit# https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools.git/+/3e08a3f71896c1c15bdcbd42a9ba28ddd0075427 @andreyt-- Could you please look into this issue, kindly reassign if it has nothing to do with your changes. Couldn't assign to andreyt@google.com, hence cc'ing. Thank You.
,
Aug 2
,
Aug 2
Issue 870125 has been merged into this issue.
,
Aug 2
Fixed with: https://github.com/KhronosGroup/SPIRV-Tools/commit/d38a0a3b4476798744c4223acbefab3af97698fd will get picked up with next SPIRV-Tools roll.
,
Aug 2
,
Aug 2
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/8574fc3bdf0871ef7c1465382128f03940b3231a commit 8574fc3bdf0871ef7c1465382128f03940b3231a Author: Dan Sinclair <dsinclair@chromium.org> Date: Thu Aug 02 22:52:51 2018 Roll SPIRV-Tools to d38a0a3 This pulls in: * d38a0a3 Validation within function body when doing a FunctionCall. * 6aa8a59 Simplify validation ProcessInstruction TBR=dsinclair@chromium.org Bug: 870156 Change-Id: Ia5fb99a01273b46602aaf49429a2ddc632d61531 Reviewed-on: https://chromium-review.googlesource.com/1161287 Reviewed-by: dsinclair <dsinclair@chromium.org> Commit-Queue: dsinclair <dsinclair@chromium.org> Cr-Commit-Position: refs/heads/master@{#580362} [modify] https://crrev.com/8574fc3bdf0871ef7c1465382128f03940b3231a/DEPS
,
Aug 3
,
Aug 3
ClusterFuzz has detected this issue as fixed in range 580360:580362. Detailed report: https://clusterfuzz.com/testcase?key=5405305811501056 Fuzzer: afl_spvtools_val_fuzzer Job Type: afl_chrome_asan Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: spvtools::val::Function::AddFunctionCallTarget spvtools::val::ValidationState_t::AddFunctionCallTarget spvtools::val::ProcessInstruction Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=579912:579914 Fixed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=580360:580362 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5405305811501056 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Aug 3
ClusterFuzz testcase 5405305811501056 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by ClusterFuzz
, Aug 2Labels: Test-Predator-Auto-Components