New issue
Advanced search Search tips

Issue 870385 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Aug 8
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Timeout in pdf_formcalc_fuzzer

Project Member Reported by ClusterFuzz, Aug 2

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6313620460535808

Fuzzer: libFuzzer_pdf_formcalc_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Timeout (exceeds 25 secs)
Crash Address: 
Crash State:
  pdf_formcalc_fuzzer
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=549284:549292

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6313620460535808

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Cc: kkaluri@chromium.org
Components: Internals>Plugins>PDF
Labels: M-68 Test-Predator-Wrong CF-NeedsTriage
Unable to provide possible suspect using Predator, CL and Code Search.
Could someone please look into the issue.

Thank You...
Owner: rharrison@chromium.org
Status: Started (was: Untriaged)
Looked into this a bit. The core issue is that there is a whole bunch of ! in a row that are taking forever to process. ! is a valid identifier beginning, but not later character, so it appears the parser is interpreting this as a bunch of identifiers in a row. This should fail because <identifier> <identifier> without any tokens in between is not valid.

Instead the parser is going into ParsePostExpression and eventually returning just the identifier as a symbol.
Project Member

Comment 4 by bugdroid1@chromium.org, Aug 8

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/6d9897b103aef10b369eb999a40c22011a8ae4f5

commit 6d9897b103aef10b369eb999a40c22011a8ae4f5
Author: Ryan Harrison <rharrison@chromium.org>
Date: Wed Aug 08 15:04:26 2018

Limit size of expression list in FormCalc parser

Limits the number of elements that can be added to the expressions
list in the FormCalc parser. This handles cases like long strings of !
repeated, since ! is a valid identifier and identifiers are valid
expression, even though it will be no-op. This is another case of
something that is valid, but stupid.

BUG= chromium:870385 

Change-Id: I8e34ce00bcbe4499e0a45bd5dc38541793144481
Reviewed-on: https://pdfium-review.googlesource.com/39630
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
Commit-Queue: Ryan Harrison <rharrison@chromium.org>

[modify] https://crrev.com/6d9897b103aef10b369eb999a40c22011a8ae4f5/xfa/fxfa/fm2js/cxfa_fmparser.cpp

Status: Fixed (was: Started)
Project Member

Comment 6 by bugdroid1@chromium.org, Aug 8

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/17526824c14518ccf473c6cec52052a2e2d53e34

commit 17526824c14518ccf473c6cec52052a2e2d53e34
Author: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Wed Aug 08 20:10:44 2018

Roll src/third_party/pdfium f90277e7f4bd..6d9897b103ae (1 commits)

https://pdfium.googlesource.com/pdfium.git/+log/f90277e7f4bd..6d9897b103ae


git log f90277e7f4bd..6d9897b103ae --date=short --no-merges --format='%ad %ae %s'
2018-08-08 rharrison@chromium.org Limit size of expression list in FormCalc parser


Created with:
  gclient setdep -r src/third_party/pdfium@6d9897b103ae

The AutoRoll server is located here: https://pdfium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.



BUG= chromium:870385 
TBR=dsinclair@chromium.org

Change-Id: Ib8c25301849b63f476191caa4b969b013dec8deb
Reviewed-on: https://chromium-review.googlesource.com/1167702
Reviewed-by: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#581677}
[modify] https://crrev.com/17526824c14518ccf473c6cec52052a2e2d53e34/DEPS

Project Member

Comment 7 by ClusterFuzz, Aug 9

ClusterFuzz has detected this issue as fixed in range 581667:581684.

Detailed report: https://clusterfuzz.com/testcase?key=6313620460535808

Fuzzer: libFuzzer_pdf_formcalc_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Timeout (exceeds 25 secs)
Crash Address: 
Crash State:
  pdf_formcalc_fuzzer
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=549284:549292
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=581667:581684

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6313620460535808

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Aug 9

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 6313620460535808 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment