Abrt in fuzz_webp_enc_dec.cc |
||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6069550178893824 Fuzzer: libFuzzer_libwebp_enc_dec_api_fuzzer Fuzz target binary: libwebp_enc_dec_api_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Abrt Crash Address: 0x053900281e9e Crash State: fuzz_webp_enc_dec.cc Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=614208:614220 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6069550178893824 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Dec 6
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/b1699763c1d7c7beccd38a6fc39bc71bab36c04f (Migrate libwebp fuzzers from OSS-Fuzz to third_party). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Dec 6
Reassigning and adding libwebp people to CC because I am not sure what's happening with the test case/crash.
,
Dec 6
Switching owners since I'm not very familiar with this code.
,
Dec 9
for the record: in order to reduce binary size, we actively voided some functions that we know are not used by Chrome's functionalities and call tree. The fuzzer is hitting these, though, hence triggering the strange assert()s.
,
Dec 11
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/58e6d60884950afe8e8383741a742eca4cd96b91 commit 58e6d60884950afe8e8383741a742eca4cd96b91 Author: Yannis Guyon <yguyon@google.com> Date: Tue Dec 11 18:21:47 2018 third_party/libwebp/fuzzing: Disable ExtractAndCropOrScale() WEBP_REDUCE_SIZE is defined in chromium, disabling WebPPictureCrop() and WebPPictureRescale(), crashing ExtractAndCropOrScale() in fuzz.h. Disable ExtractAndCropOrScale() without returning an error when WEBP_REDUCE_SIZE is defined. BUG= chromium:912455 Change-Id: I10f66de59498f664d7e0603cfd10698fa3f5f114 Reviewed-on: https://chromium-review.googlesource.com/c/1368108 Commit-Queue: Yannis Guyon <yguyon@google.com> Reviewed-by: James Zern <jzern@google.com> Cr-Commit-Position: refs/heads/master@{#615594} [modify] https://crrev.com/58e6d60884950afe8e8383741a742eca4cd96b91/third_party/libwebp/fuzzing/fuzz.h
,
Dec 12
,
Dec 12
ClusterFuzz has detected this issue as fixed in range 615591:615600. Detailed report: https://clusterfuzz.com/testcase?key=6069550178893824 Fuzzer: libFuzzer_libwebp_enc_dec_api_fuzzer Fuzz target binary: libwebp_enc_dec_api_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Abrt Crash Address: 0x053900281e9e Crash State: fuzz_webp_enc_dec.cc Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=614208:614220 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=615591:615600 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6069550178893824 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Dec 12
ClusterFuzz testcase 6069550178893824 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by ClusterFuzz
, Dec 6Labels: ClusterFuzz-Auto-CC