New issue
Advanced search Search tips

Issue 870952 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Aug 8
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in TryVSWPrintf

Project Member Reported by ClusterFuzz, Aug 4

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6046712033181696

Fuzzer: libFuzzer_pdfium_xfa_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  TryVSWPrintf
  fxcrt::WideString::FormatV
  CFXJSE_FormCalcContext::ThrowException
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=555725:555734

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6046712033181696

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Aug 4

Components: Internals>Plugins>PDF
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: kkaluri@chromium.org
Labels: M-69 Test-Predator-Wrong
Owner: tsepez@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.

Using Code Search for the file, "widestring.cpp" suspecting the below Cl might have caused this issue

Suspect CL: https://pdfium.googlesource.com/pdfium.git/+/154e18f9a862975abecebe77b8f5fb418418d14c

tsepez@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!
Probably long-time pre-existing condition.  Let's try https://pdfium-review.googlesource.com/c/pdfium/+/39551 to tighten some things up.
Project Member

Comment 4 by bugdroid1@chromium.org, Aug 7

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/405d5d9c6d1e0b4c5911732ab34ccff095e70067

commit 405d5d9c6d1e0b4c5911732ab34ccff095e70067
Author: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Tue Aug 07 23:57:45 2018

Roll src/third_party/pdfium f3a3393a2f96..e1c2f6d7fe7a (5 commits)

https://pdfium.googlesource.com/pdfium.git/+log/f3a3393a2f96..e1c2f6d7fe7a


git log f3a3393a2f96..e1c2f6d7fe7a --date=short --no-merges --format='%ad %ae %s'
2018-08-07 tsepez@chromium.org Remove WideString::Format() from ThrowException() methods.
2018-08-07 tsepez@chromium.org Use wide string addition in place of some Format() calls.
2018-08-07 tsepez@chromium.org Add test for {Byte,Wide}String Operator+().
2018-08-07 tsepez@chromium.org Combine redundant CJBig2_Image code.
2018-08-07 tsepez@chromium.org Speculative fix for null deref above ThrowNoDefaultPropertyException


Created with:
  gclient setdep -r src/third_party/pdfium@e1c2f6d7fe7a

The AutoRoll server is located here: https://pdfium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.



BUG= chromium:870952 
TBR=dsinclair@chromium.org

Change-Id: I10fe6cd6f0dd97baf6b7e2f3b774bab1558c9875
Reviewed-on: https://chromium-review.googlesource.com/1166042
Reviewed-by: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#581395}
[modify] https://crrev.com/405d5d9c6d1e0b4c5911732ab34ccff095e70067/DEPS

Project Member

Comment 5 by ClusterFuzz, Aug 8

ClusterFuzz has detected this issue as fixed in range 581394:581396.

Detailed report: https://clusterfuzz.com/testcase?key=6046712033181696

Fuzzer: libFuzzer_pdfium_xfa_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  TryVSWPrintf
  fxcrt::WideString::FormatV
  CFXJSE_FormCalcContext::ThrowException
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=555725:555734
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=581394:581396

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6046712033181696

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Aug 8

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6046712033181696 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment