New issue
Advanced search Search tips

Issue 903724 link

Starred by 2 users

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Chrome , Mac
Pri: 1
Type: Bug



Sign in to add a comment

Out-of-memory in pdf_jpx_fuzzer

Project Member Reported by ClusterFuzz, Nov 9

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5468582076743680

Fuzzer: libFuzzer_pdf_jpx_fuzzer
Job Type: windows_libfuzzer_chrome_asan
Platform Id: windows

Crash Type: Out-of-memory (exceeds 2048 MB)
Crash Address: 
Crash State:
  pdf_jpx_fuzzer
  
Sanitizer: address (ASAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5468582076743680

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing_on_windows.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 9

Labels: OS-Linux
Project Member

Comment 2 by ClusterFuzz, Nov 10

Labels: OS-Mac
Labels: M-71 Test-Predator-Wrong CF-NeedsTriage
Unable to find actual suspect through code search and also observing no CL's under regression range, hence adding appropriate label and requesting someone from dev team to look in to this issue.

Thanks!
Components: Internals>Plugins>PDF
Status: Available (was: Untriaged)
Probably an OpenJPEG issue.
Owner: npm@chromium.org
Status: Started (was: Available)
Project Member

Comment 7 by bugdroid1@chromium.org, Nov 16

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/fa7983ef8c0a5e84819cda14bae56ee87c925654

commit fa7983ef8c0a5e84819cda14bae56ee87c925654
Author: Nicolas Pena <npm@chromium.org>
Date: Fri Nov 16 21:54:51 2018

Improve JPX fuzzer

This CL splits initialization into two parts so that the fuzzer can
check for enormous sizes in headers before calling the opj decoding
code.

Bug: chromium:903724
Change-Id: I1dc7095d65b55319cb748d8a24206d72dd66390d
Reviewed-on: https://pdfium-review.googlesource.com/c/45732
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Nicolás Peña Moreno <npm@chromium.org>

[modify] https://crrev.com/fa7983ef8c0a5e84819cda14bae56ee87c925654/core/fxcodec/codec/ccodec_jpxmodule.cpp
[modify] https://crrev.com/fa7983ef8c0a5e84819cda14bae56ee87c925654/core/fpdfapi/render/cpdf_dibbase.cpp
[modify] https://crrev.com/fa7983ef8c0a5e84819cda14bae56ee87c925654/testing/fuzzers/pdf_jpx_fuzzer.cc
[modify] https://crrev.com/fa7983ef8c0a5e84819cda14bae56ee87c925654/core/fxcodec/codec/cjpx_decoder.h

Project Member

Comment 8 by bugdroid1@chromium.org, Nov 16

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1d2043b9f1257ac2b9b3e3c8f2ec81817f42d9b2

commit 1d2043b9f1257ac2b9b3e3c8f2ec81817f42d9b2
Author: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Date: Fri Nov 16 23:46:21 2018

Roll src/third_party/pdfium 75d214c50d2f..a8b6376430de (6 commits)

https://pdfium.googlesource.com/pdfium.git/+log/75d214c50d2f..a8b6376430de


git log 75d214c50d2f..a8b6376430de --date=short --no-merges --format='%ad %ae %s'
2018-11-16 thestig@chromium.org Use another enum class in CBC_PDF417HighLevelEncoder.
2018-11-16 thestig@chromium.org Use enum class in CBC_PDF417HighLevelEncoder.
2018-11-16 thestig@chromium.org More CBC_PDF417HighLevelEncoder cleanup.
2018-11-16 thestig@chromium.org Simplify fx_opj_stream_create_memory_stream().
2018-11-16 npm@chromium.org Improve JPX fuzzer
2018-11-16 thestig@chromium.org Slightly simplify CPDF_FontEncoding::Realize().


Created with:
  gclient setdep -r src/third_party/pdfium@a8b6376430de

The AutoRoll server is located here: https://autoroll.skia.org/r/pdfium-autoroll

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.



BUG=chromium:903724
TBR=dsinclair@chromium.org

Change-Id: Ic5098a9f104a0caaabf4ebe41d55a048223dda2c
Reviewed-on: https://chromium-review.googlesource.com/c/1340398
Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#609026}
[modify] https://crrev.com/1d2043b9f1257ac2b9b3e3c8f2ec81817f42d9b2/DEPS

Labels: -CF-NeedsTriage
Thanks for taking on this bug. ClusterFuzz has been re-testing and still hits an OOM condition. Thus it did not automatically close the bug. Let me know if you want me to test this out on Windows and see if it's a Windows-only problem.
Hmm I'm still able to reproduce on Linux so I don't know if the testcase changed, or I somehow didn't test it correctly in the first place. I can take a look at it later, or feel free to dig in if you'd like.
Project Member

Comment 12 by ClusterFuzz, Dec 1

Labels: -Reproducible Unreproducible
ClusterFuzz testcase 5468582076743680 appears to be flaky, updating reproducibility label.
Labels: -Unreproducible Reproducible
Please ignore the last comment about testcase being unreproducible. The testcase is still reproducible. This happened due to a code refactoring on ClusterFuzz side, and the underlying root cause is now fixed. Resetting the label back to Reproducible. Sorry about the inconvenience caused from these incorrect notifications.
Project Member

Comment 14 by ClusterFuzz, Dec 4

Labels: OS-Chrome
The documentation for reproducing on Windows has been moved to https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md

Comment 16 by npm@chromium.org, Jan 16 (6 days ago)

Owner: thestig@chromium.org
Status: Assigned (was: Started)
This is marked P1 and I don't have time to prioritize it as such so over to thestig@

Sign in to add a comment