New issue
Advanced search Search tips

Issue 902649 link

Starred by 2 users

Issue metadata

Status: Verified
Owner: ----
Closed: Nov 26
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 3
Type: Bug



Sign in to add a comment

Null-dereference READ in ures_getVersionByKey

Project Member Reported by ClusterFuzz, Nov 7

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5733643382947840

Fuzzer: ifratric-browserfuzzer-v3
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  ures_getVersionByKey
  ures_getVersionByKey
  ures_getLocale
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=599365:599383

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5733643382947840

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 7

Components: Blink>Forms Platform
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: kkaluri@chromium.org
Labels: M-72 Test-Predator-Wrong CF-NeedsTriage
Unable to find actual suspect through code search and also observing no CL's under regression range, hence adding appropriate label and requesting someone from dev team to look in to this issue.

Thanks!
Labels: -Pri-1 Pri-3
Status: Available (was: Untriaged)
I couldn't reproduce this locally.
This looks an OS bug.  We might able to avoid the bug by avoiding a problematic parameters, but it's difficult to do so without reproducing this.

Cc: mmoroz@chromium.org
Labels: -CF-NeedsTriage
mmoroz@, Just wondering do you have any comments for c#3?
Cc: tkent@chromium.org
Can we try a speculative fix for this, since CF seems to be able to reproduce it reliably?
Project Member

Comment 6 by ClusterFuzz, Nov 26

ClusterFuzz has detected this issue as fixed in range 610771:610776.

Detailed report: https://clusterfuzz.com/testcase?key=5733643382947840

Fuzzer: ifratric-browserfuzzer-v3
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  ures_getVersionByKey
  ures_getVersionByKey
  ures_getLocale
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=599365:599383
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=610771:610776

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5733643382947840

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Nov 26

Labels: ClusterFuzz-Verified
Status: Verified (was: Available)
ClusterFuzz testcase 5733643382947840 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment