New issue
Advanced search Search tips

Issue 896661 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jan 10
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Integer-overflow in TrilinearInterp16

Project Member Reported by ClusterFuzz, Oct 18

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6090395635941376

Fuzzer: libFuzzer_pdf_codec_icc_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  TrilinearInterp16
  EvaluateCLUTfloatIn16
  _LUTevalFloat
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=420371:420606

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6090395635941376

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Oct 18

Components: Internals>Plugins>PDF
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Oct 18

Cc: dsinclair@chromium.org jam@chromium.org brucedaw...@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 3 by ClusterFuzz, Oct 18

Labels: Test-Predator-Auto-Owner
Owner: kcwu@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://pdfium.googlesource.com/pdfium/+/39ee9dfac1c6d286a4075c7e2435fe1cfe365bad (Fix memory leaks in lcms).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Cc: -jam@chromium.org -brucedaw...@chromium.org -dsinclair@chromium.org
Owner: tsepez@chromium.org
This is similar to  bug 649832 .
Project Member

Comment 5 by ClusterFuzz, Dec 1

Labels: -Reproducible Unreproducible
ClusterFuzz testcase 6090395635941376 appears to be flaky, updating reproducibility label.
Labels: -Unreproducible Reproducible
Please ignore the last comment about testcase being unreproducible. The testcase is still reproducible. This happened due to a code refactoring on ClusterFuzz side, and the underlying root cause is now fixed. Resetting the label back to Reproducible. Sorry about the inconvenience caused from these incorrect notifications.
Labels: -Unreproducible Reproducible
Please ignore the last comment about testcase being unreproducible. The testcase is still reproducible. This happened due to a code refactoring on ClusterFuzz side, and the underlying root cause is now fixed. Resetting the label back to Reproducible. Sorry about the inconvenience caused from these incorrect notifications.
Project Member

Comment 8 by ClusterFuzz, Jan 10

ClusterFuzz has detected this issue as fixed in range 621424:621441.

Detailed report: https://clusterfuzz.com/testcase?key=6090395635941376

Fuzzer: libFuzzer_pdf_codec_icc_fuzzer
Fuzz target binary: pdf_codec_icc_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  TrilinearInterp16
  EvaluateCLUTfloatIn16
  _LUTevalFloat
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=420371:420606
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=621424:621441

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6090395635941376

See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Jan 10

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6090395635941376 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment