New issue
Advanced search Search tips

Issue 906350 link

Starred by 1 user

Issue metadata

Status: Verified
Owner: ----
Closed: Dec 17
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Integer-overflow in mz_zip_entry_read_open

Project Member Reported by ClusterFuzz, Nov 17

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4882536347729920

Fuzzer: libFuzzer_minizip_uncompress_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  mz_zip_entry_read_open
  minizip_uncompress_fuzzer.cc
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=605984:605985

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4882536347729920

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 17

Cc: yawano@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 2 by ClusterFuzz, Nov 17

Cc: nat...@solidstatenetworks.com
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Attempt to correct for invalid central dir offsets. #340 by nathan@solidstatenetworks.com - https://chromium.googlesource.com/external/github.com/nmoinvaz/minizip/+/aacf87304ed93449e7a8b31a60a759fb97dbc184

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Cc: -nat...@solidstatenetworks.com nathan.m...@gmail.com amistry@chromium.org
Components: Platform>Apps>FileManager
Labels: CrOSFilesFeature-Zip
Status: Available (was: Untriaged)
Stacktrace:
../../third_party/minizip/src/mz_zip.c:1751:66: runtime error: signed integer overflow: -9223372036849205248 + -4294904064 cannot be represented in type 'long'
     #0 0x555f27fc7295 in mz_zip_entry_read_open third_party/minizip/src/mz_zip.c:1751:66
     #1 0x555f27ecfff6 in LLVMFuzzerTestOneInput third_party/minizip/minizip_uncompress_fuzzer.cc:48:16
    #2 0x555f27edc5d5 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:571:15
    #3 0x555f27ed30fc in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:280:6
    #4 0x555f27ed57bb in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:713:9
    #5 0x555f27ee22c2 in main third_party/libFuzzer/src/FuzzerMain.cpp:20:10
Project Member

Comment 5 by ClusterFuzz, Dec 1

Labels: -Reproducible Unreproducible
ClusterFuzz testcase 4882536347729920 appears to be flaky, updating reproducibility label.
Labels: -Unreproducible Reproducible
Please ignore the last comment about testcase being unreproducible. The testcase is still reproducible. This happened due to a code refactoring on ClusterFuzz side, and the underlying root cause is now fixed. Resetting the label back to Reproducible. Sorry about the inconvenience caused from these incorrect notifications.
Project Member

Comment 8 by ClusterFuzz, Dec 17

ClusterFuzz has detected this issue as fixed in range 617047:617048.

Detailed report: https://clusterfuzz.com/testcase?key=4882536347729920

Fuzzer: libFuzzer_minizip_uncompress_fuzzer
Fuzz target binary: minizip_uncompress_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  mz_zip_entry_read_open
  minizip_uncompress_fuzzer.cc
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=605984:605985
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=617047:617048

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4882536347729920

See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Dec 17

Labels: ClusterFuzz-Verified
Status: Verified (was: Available)
ClusterFuzz testcase 4882536347729920 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment