Null-dereference READ in spvtools::val::Instruction::id |
|||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5763962256490496 Fuzzer: afl_spvtools_val_fuzzer Job Type: afl_chrome_asan Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000044 Crash State: spvtools::val::Instruction::id bool spvtools::val::idUsage::isValid< spvtools::val::idUsage::isValid Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=579912:579914 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5763962256490496 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Aug 7
Predator has provided 8 possible suspects. 1. Stats analyzer uses validator by andreyt@google.com 2. Remove source/instruction.cpp by dneto@google.com 3. Stats analyzer aggregates OpConstant usage by andreyt@google.com 4. Make sure all instructions are in the ordered list. by dsinclair@chromium.org 5. Remove unnecessary headers by umar@arrayfire.com 6. Convert validation to use libspriv::Instruction where possible. (#1663) by dj2@everburning.com 7. Change libspirv to spvtools namespace (#1678) by dj2@everburning.com 8. Re-format files in source, source/opt, source/util, source/val and tools. by dnovillo@google.com Using Code Search for the file, "source/val/instruction.h" suspecting the below Cl might have caused this issue Assigning to dsinclair@ for his recent work on above file dsinclair@ -- Could you please look into this issue. Thanks!
,
Aug 7
,
Aug 12
,
Aug 13
,
Aug 14
Expect this is fixed by https://github.com/KhronosGroup/SPIRV-Tools/commit/e7fdcdba75eda1f5a70d689cf50628389efa3ed0
,
Aug 15
ClusterFuzz has detected this issue as fixed in range 583092:583110. Detailed report: https://clusterfuzz.com/testcase?key=5763962256490496 Fuzzer: afl_spvtools_val_fuzzer Job Type: afl_chrome_asan Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000044 Crash State: spvtools::val::Instruction::id bool spvtools::val::idUsage::isValid< spvtools::val::idUsage::isValid Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=579912:579914 Fixed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=583092:583110 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5763962256490496 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Aug 15
ClusterFuzz testcase 5763962256490496 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by ClusterFuzz
, Aug 6Labels: Test-Predator-Auto-Components