New issue
Advanced search Search tips

Issue 871034 link

Starred by 2 users

Issue metadata

Status: Verified
Owner: ----
Closed: Aug 10
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in bool base::ContainsKey<std::__1::map<std::__1::basic_string<char, std::__1::char

Project Member Reported by ClusterFuzz, Aug 4

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5612137209397248

Fuzzer: libFuzzer_clear_site_data_fuzzer
Job Type: mac_libfuzzer_chrome_asan
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x000000000020
Crash State:
  bool base::ContainsKey<std::__1::map<std::__1::basic_string<char, std::__1::char
  base::CommandLine::HasSwitch
  content::ClearSiteDataThrottle::ParseHeader
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=580747:580752

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5612137209397248

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Aug 4

Components: Internals>Core Privacy
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: kkaluri@chromium.org
Labels: M-70 CF-NeedsTriage Test-Predator-Wrong
Unable to find actual suspect through code search and also observing no CL's under regression range, hence adding appropriate label and requesting someone from dev team to look in to this issue.
Project Member

Comment 3 by ClusterFuzz, Aug 10

ClusterFuzz has detected this issue as fixed in range 581993:582026.

Detailed report: https://clusterfuzz.com/testcase?key=5612137209397248

Fuzzer: libFuzzer_clear_site_data_fuzzer
Job Type: mac_libfuzzer_chrome_asan
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x000000000020
Crash State:
  bool base::ContainsKey<std::__1::map<std::__1::basic_string<char, std::__1::char
  base::CommandLine::HasSwitch
  content::ClearSiteDataThrottle::ParseHeader
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=580747:580752
Fixed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=581993:582026

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5612137209397248

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 4 by ClusterFuzz, Aug 10

Labels: ClusterFuzz-Verified
Status: Verified (was: Untriaged)
ClusterFuzz testcase 5612137209397248 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment