Null-dereference READ in TryVSWPrintf |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6046712033181696 Fuzzer: libFuzzer_pdfium_xfa_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: TryVSWPrintf fxcrt::WideString::FormatV CFXJSE_FormCalcContext::ThrowException Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=555725:555734 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6046712033181696 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Aug 6
Predator and CL could not provide any possible suspects. Using Code Search for the file, "widestring.cpp" suspecting the below Cl might have caused this issue Suspect CL: https://pdfium.googlesource.com/pdfium.git/+/154e18f9a862975abecebe77b8f5fb418418d14c tsepez@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner. Thanks!
,
Aug 7
Probably long-time pre-existing condition. Let's try https://pdfium-review.googlesource.com/c/pdfium/+/39551 to tighten some things up.
,
Aug 7
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/405d5d9c6d1e0b4c5911732ab34ccff095e70067 commit 405d5d9c6d1e0b4c5911732ab34ccff095e70067 Author: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Date: Tue Aug 07 23:57:45 2018 Roll src/third_party/pdfium f3a3393a2f96..e1c2f6d7fe7a (5 commits) https://pdfium.googlesource.com/pdfium.git/+log/f3a3393a2f96..e1c2f6d7fe7a git log f3a3393a2f96..e1c2f6d7fe7a --date=short --no-merges --format='%ad %ae %s' 2018-08-07 tsepez@chromium.org Remove WideString::Format() from ThrowException() methods. 2018-08-07 tsepez@chromium.org Use wide string addition in place of some Format() calls. 2018-08-07 tsepez@chromium.org Add test for {Byte,Wide}String Operator+(). 2018-08-07 tsepez@chromium.org Combine redundant CJBig2_Image code. 2018-08-07 tsepez@chromium.org Speculative fix for null deref above ThrowNoDefaultPropertyException Created with: gclient setdep -r src/third_party/pdfium@e1c2f6d7fe7a The AutoRoll server is located here: https://pdfium-roll.skia.org Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. BUG= chromium:870952 TBR=dsinclair@chromium.org Change-Id: I10fe6cd6f0dd97baf6b7e2f3b774bab1558c9875 Reviewed-on: https://chromium-review.googlesource.com/1166042 Reviewed-by: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Commit-Queue: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#581395} [modify] https://crrev.com/405d5d9c6d1e0b4c5911732ab34ccff095e70067/DEPS
,
Aug 8
ClusterFuzz has detected this issue as fixed in range 581394:581396. Detailed report: https://clusterfuzz.com/testcase?key=6046712033181696 Fuzzer: libFuzzer_pdfium_xfa_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: TryVSWPrintf fxcrt::WideString::FormatV CFXJSE_FormCalcContext::ThrowException Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=555725:555734 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=581394:581396 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6046712033181696 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Aug 8
ClusterFuzz testcase 6046712033181696 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||
►
Sign in to add a comment |
|||
Comment 1 by ClusterFuzz
, Aug 4Labels: Test-Predator-Auto-Components