Out-of-memory in pdf_jpx_fuzzer |
|||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5468582076743680 Fuzzer: libFuzzer_pdf_jpx_fuzzer Job Type: windows_libfuzzer_chrome_asan Platform Id: windows Crash Type: Out-of-memory (exceeds 2048 MB) Crash Address: Crash State: pdf_jpx_fuzzer Sanitizer: address (ASAN) Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5468582076743680 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing_on_windows.md for more information.
,
Nov 10
,
Nov 12
Unable to find actual suspect through code search and also observing no CL's under regression range, hence adding appropriate label and requesting someone from dev team to look in to this issue. Thanks!
,
Nov 16
,
Nov 16
Probably an OpenJPEG issue.
,
Nov 16
,
Nov 16
The following revision refers to this bug: https://pdfium.googlesource.com/pdfium/+/fa7983ef8c0a5e84819cda14bae56ee87c925654 commit fa7983ef8c0a5e84819cda14bae56ee87c925654 Author: Nicolas Pena <npm@chromium.org> Date: Fri Nov 16 21:54:51 2018 Improve JPX fuzzer This CL splits initialization into two parts so that the fuzzer can check for enormous sizes in headers before calling the opj decoding code. Bug: chromium:903724 Change-Id: I1dc7095d65b55319cb748d8a24206d72dd66390d Reviewed-on: https://pdfium-review.googlesource.com/c/45732 Reviewed-by: Tom Sepez <tsepez@chromium.org> Commit-Queue: Nicolás Peña Moreno <npm@chromium.org> [modify] https://crrev.com/fa7983ef8c0a5e84819cda14bae56ee87c925654/core/fxcodec/codec/ccodec_jpxmodule.cpp [modify] https://crrev.com/fa7983ef8c0a5e84819cda14bae56ee87c925654/core/fpdfapi/render/cpdf_dibbase.cpp [modify] https://crrev.com/fa7983ef8c0a5e84819cda14bae56ee87c925654/testing/fuzzers/pdf_jpx_fuzzer.cc [modify] https://crrev.com/fa7983ef8c0a5e84819cda14bae56ee87c925654/core/fxcodec/codec/cjpx_decoder.h
,
Nov 16
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/1d2043b9f1257ac2b9b3e3c8f2ec81817f42d9b2 commit 1d2043b9f1257ac2b9b3e3c8f2ec81817f42d9b2 Author: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Date: Fri Nov 16 23:46:21 2018 Roll src/third_party/pdfium 75d214c50d2f..a8b6376430de (6 commits) https://pdfium.googlesource.com/pdfium.git/+log/75d214c50d2f..a8b6376430de git log 75d214c50d2f..a8b6376430de --date=short --no-merges --format='%ad %ae %s' 2018-11-16 thestig@chromium.org Use another enum class in CBC_PDF417HighLevelEncoder. 2018-11-16 thestig@chromium.org Use enum class in CBC_PDF417HighLevelEncoder. 2018-11-16 thestig@chromium.org More CBC_PDF417HighLevelEncoder cleanup. 2018-11-16 thestig@chromium.org Simplify fx_opj_stream_create_memory_stream(). 2018-11-16 npm@chromium.org Improve JPX fuzzer 2018-11-16 thestig@chromium.org Slightly simplify CPDF_FontEncoding::Realize(). Created with: gclient setdep -r src/third_party/pdfium@a8b6376430de The AutoRoll server is located here: https://autoroll.skia.org/r/pdfium-autoroll Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. BUG=chromium:903724 TBR=dsinclair@chromium.org Change-Id: Ic5098a9f104a0caaabf4ebe41d55a048223dda2c Reviewed-on: https://chromium-review.googlesource.com/c/1340398 Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#609026} [modify] https://crrev.com/1d2043b9f1257ac2b9b3e3c8f2ec81817f42d9b2/DEPS
,
Nov 20
,
Nov 29
Thanks for taking on this bug. ClusterFuzz has been re-testing and still hits an OOM condition. Thus it did not automatically close the bug. Let me know if you want me to test this out on Windows and see if it's a Windows-only problem.
,
Nov 29
Hmm I'm still able to reproduce on Linux so I don't know if the testcase changed, or I somehow didn't test it correctly in the first place. I can take a look at it later, or feel free to dig in if you'd like.
,
Dec 1
ClusterFuzz testcase 5468582076743680 appears to be flaky, updating reproducibility label.
,
Dec 1
Please ignore the last comment about testcase being unreproducible. The testcase is still reproducible. This happened due to a code refactoring on ClusterFuzz side, and the underlying root cause is now fixed. Resetting the label back to Reproducible. Sorry about the inconvenience caused from these incorrect notifications.
,
Dec 4
,
Dec 14
The documentation for reproducing on Windows has been moved to https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md
,
Jan 16
(6 days ago)
This is marked P1 and I don't have time to prioritize it as such so over to thestig@ |
|||||||||||
►
Sign in to add a comment |
|||||||||||
Comment 1 by ClusterFuzz
, Nov 9