New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 910239 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Last visit 18 days ago
Closed: Dec 4
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in spvtools::val::Instruction::opcode

Project Member Reported by ClusterFuzz, Nov 29

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5737804925239296

Fuzzer: libFuzzer_spvtools_val_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x00000000003a
Crash State:
  spvtools::val::Instruction::opcode
  spvtools::val::ValidateArrayLength
  spvtools::val::MemoryPass
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=611369:611409

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5737804925239296

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 29

Components: Internals>GPU>Internals
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Nov 29

Cc: dsinclair@chromium.org vmi...@chromium.org piman@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 3 by ClusterFuzz, Nov 29

Labels: Test-Predator-Auto-Owner
Owner: stevenperron@google.com
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools/+/4e22b601224b1ddc3eb60ab38d9d1d89e81135e5 (Add validation for OpArrayLength. (#2117)).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Cc: stevenperron@google.com
Owner: alanbaker@google.com
Project Member

Comment 5 by ClusterFuzz, Dec 1

Labels: -Reproducible Unreproducible
ClusterFuzz testcase 5737804925239296 appears to be flaky, updating reproducibility label.
Labels: -Unreproducible Reproducible
Please ignore the last comment about testcase being unreproducible. The testcase is still reproducible. This happened due to a code refactoring on ClusterFuzz side, and the underlying root cause is now fixed. Resetting the label back to Reproducible. Sorry about the inconvenience caused from these incorrect notifications.
Project Member

Comment 7 by ClusterFuzz, Dec 4

ClusterFuzz has detected this issue as fixed in range 613208:613234.

Detailed report: https://clusterfuzz.com/testcase?key=5737804925239296

Fuzzer: libFuzzer_spvtools_val_fuzzer
Fuzz target binary: spvtools_val_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x00000000003a
Crash State:
  spvtools::val::Instruction::opcode
  spvtools::val::ValidateArrayLength
  spvtools::val::MemoryPass
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=611369:611409
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=613208:613234

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5737804925239296

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Dec 4

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5737804925239296 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment