Timeout in pdf_formcalc_fuzzer |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6313620460535808 Fuzzer: libFuzzer_pdf_formcalc_fuzzer Job Type: libfuzzer_chrome_msan Platform Id: linux Crash Type: Timeout (exceeds 25 secs) Crash Address: Crash State: pdf_formcalc_fuzzer Sanitizer: memory (MSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=549284:549292 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6313620460535808 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Aug 3
,
Aug 7
Looked into this a bit. The core issue is that there is a whole bunch of ! in a row that are taking forever to process. ! is a valid identifier beginning, but not later character, so it appears the parser is interpreting this as a bunch of identifiers in a row. This should fail because <identifier> <identifier> without any tokens in between is not valid. Instead the parser is going into ParsePostExpression and eventually returning just the identifier as a symbol.
,
Aug 8
The following revision refers to this bug: https://pdfium.googlesource.com/pdfium/+/6d9897b103aef10b369eb999a40c22011a8ae4f5 commit 6d9897b103aef10b369eb999a40c22011a8ae4f5 Author: Ryan Harrison <rharrison@chromium.org> Date: Wed Aug 08 15:04:26 2018 Limit size of expression list in FormCalc parser Limits the number of elements that can be added to the expressions list in the FormCalc parser. This handles cases like long strings of ! repeated, since ! is a valid identifier and identifiers are valid expression, even though it will be no-op. This is another case of something that is valid, but stupid. BUG= chromium:870385 Change-Id: I8e34ce00bcbe4499e0a45bd5dc38541793144481 Reviewed-on: https://pdfium-review.googlesource.com/39630 Reviewed-by: Henrique Nakashima <hnakashima@chromium.org> Commit-Queue: Ryan Harrison <rharrison@chromium.org> [modify] https://crrev.com/6d9897b103aef10b369eb999a40c22011a8ae4f5/xfa/fxfa/fm2js/cxfa_fmparser.cpp
,
Aug 8
,
Aug 8
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/17526824c14518ccf473c6cec52052a2e2d53e34 commit 17526824c14518ccf473c6cec52052a2e2d53e34 Author: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Date: Wed Aug 08 20:10:44 2018 Roll src/third_party/pdfium f90277e7f4bd..6d9897b103ae (1 commits) https://pdfium.googlesource.com/pdfium.git/+log/f90277e7f4bd..6d9897b103ae git log f90277e7f4bd..6d9897b103ae --date=short --no-merges --format='%ad %ae %s' 2018-08-08 rharrison@chromium.org Limit size of expression list in FormCalc parser Created with: gclient setdep -r src/third_party/pdfium@6d9897b103ae The AutoRoll server is located here: https://pdfium-roll.skia.org Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. BUG= chromium:870385 TBR=dsinclair@chromium.org Change-Id: Ib8c25301849b63f476191caa4b969b013dec8deb Reviewed-on: https://chromium-review.googlesource.com/1167702 Reviewed-by: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Commit-Queue: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#581677} [modify] https://crrev.com/17526824c14518ccf473c6cec52052a2e2d53e34/DEPS
,
Aug 9
ClusterFuzz has detected this issue as fixed in range 581667:581684. Detailed report: https://clusterfuzz.com/testcase?key=6313620460535808 Fuzzer: libFuzzer_pdf_formcalc_fuzzer Job Type: libfuzzer_chrome_msan Platform Id: linux Crash Type: Timeout (exceeds 25 secs) Crash Address: Crash State: pdf_formcalc_fuzzer Sanitizer: memory (MSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=549284:549292 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=581667:581684 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6313620460535808 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Aug 9
ClusterFuzz testcase 6313620460535808 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by kkaluri@chromium.org
, Aug 3Components: Internals>Plugins>PDF
Labels: M-68 Test-Predator-Wrong CF-NeedsTriage