New issue
Advanced search Search tips

Issue 906354 link

Starred by 1 user

Issue metadata

Status: Verified
Owner: ----
Closed: Dec 17
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Integer-overflow in mz_zip_read_cd

Project Member Reported by ClusterFuzz, Nov 17

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5986946159214592

Fuzzer: libFuzzer_minizip_uncompress_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  mz_zip_read_cd
  mz_zip_open
  minizip_uncompress_fuzzer.cc
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=605268:605272

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5986946159214592

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 17

Cc: yawano@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Cc: nat...@solidstatenetworks.com kkaluri@chromium.org
Labels: M-72
Predator and CL could not provide any possible suspects.
Using the code search for the file, “mz_zip.c” assigning to owner concerned from GIT blame.
Suspecting Commit#
https://chromium.googlesource.com/external/github.com/nmoinvaz/minizip/+/0dfcdf91ba08a8422c8a9506a28e80685d893ec1

@nathan -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes.

Note - Couldn't assign to nathan@solidstatenetworks.com,. Hence, cc'ing.

Thank You.

Comment 3 Deleted

Please assign to this email. I don't know why the wrong email keeps getting added.
Also, can you please attach the test case or email it to me, as clusterfuzz.com is not accessible to me.
Cc: -nat...@solidstatenetworks.com nathan.m...@gmail.com amistry@chromium.org
Components: Platform>Apps>FileManager
Labels: CrOSFilesFeature-Zip
Status: Available (was: Untriaged)
Nathan: Looks like CC is based on the git commit email address, hence why that address is getting added.
Stacktrace:
../../third_party/minizip/src/mz_zip.c:988:56: runtime error: signed integer overflow: 6 - -9223372036854775808 cannot be represented in type 'long'
     #0 0x55cfc4675c9b in mz_zip_read_cd third_party/minizip/src/mz_zip.c:988:56
     #1 0x55cfc46751fb in mz_zip_open third_party/minizip/src/mz_zip.c:1328:19
     #2 0x55cfc457fe17 in LLVMFuzzerTestOneInput third_party/minizip/minizip_uncompress_fuzzer.cc:29:16
    #3 0x55cfc458c5d5 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:571:15
    #4 0x55cfc45830fc in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:280:6
    #5 0x55cfc45857bb in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:713:9
    #6 0x55cfc45922c2 in main third_party/libFuzzer/src/FuzzerMain.cpp:20:10
Thanks - that makes sense with the git commit e-mail address. 
This should be resolved now. The test case should no longer be a problem.
Project Member

Comment 10 by ClusterFuzz, Dec 1

Labels: -Reproducible Unreproducible
ClusterFuzz testcase 5986946159214592 appears to be flaky, updating reproducibility label.
Labels: -Unreproducible Reproducible
Please ignore the last comment about testcase being unreproducible. The testcase is still reproducible. This happened due to a code refactoring on ClusterFuzz side, and the underlying root cause is now fixed. Resetting the label back to Reproducible. Sorry about the inconvenience caused from these incorrect notifications.
Are you sure? I tested it again, and it doesn't appear to be a problem. Also there is a check in mz_stream_seek for negative seek values on MZ_SEEK_SET now.
This test is for chromium's fuzzer, which runs against chromium's pinned version. Once I uprev minizip again in chromium, this should will probably be closed automatically.
Project Member

Comment 15 by ClusterFuzz, Dec 17

ClusterFuzz has detected this issue as fixed in range 617047:617048.

Detailed report: https://clusterfuzz.com/testcase?key=5986946159214592

Fuzzer: libFuzzer_minizip_uncompress_fuzzer
Fuzz target binary: minizip_uncompress_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  mz_zip_read_cd
  mz_zip_open
  minizip_uncompress_fuzzer.cc
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=605268:605272
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=617047:617048

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5986946159214592

See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 16 by ClusterFuzz, Dec 17

Labels: ClusterFuzz-Verified
Status: Verified (was: Available)
ClusterFuzz testcase 5986946159214592 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment