New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 912455 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Dec 12
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Abrt in fuzz_webp_enc_dec.cc

Project Member Reported by ClusterFuzz, Dec 6

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6069550178893824

Fuzzer: libFuzzer_libwebp_enc_dec_api_fuzzer
Fuzz target binary: libwebp_enc_dec_api_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x053900281e9e
Crash State:
  fuzz_webp_enc_dec.cc
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=614208:614220

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6069550178893824

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Dec 6

Cc: mbarow...@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 2 by ClusterFuzz, Dec 6

Labels: Test-Predator-Auto-Owner
Owner: mbarow...@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/b1699763c1d7c7beccd38a6fc39bc71bab36c04f (Migrate libwebp fuzzers from OSS-Fuzz to third_party).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Cc: jzern@chromium.org skal@google.com yguyon@google.com
Owner: mbarbe...@chromium.org
Reassigning and adding libwebp people to CC because I am not sure what's happening with the test case/crash.
Cc: mbarbe...@chromium.org
Owner: yguyon@google.com
Switching owners since I'm not very familiar with this code.
for the record: in order to reduce binary size, we actively voided some functions that we know are not used by Chrome's functionalities and call tree. The fuzzer is hitting these, though, hence triggering the strange assert()s.
Project Member

Comment 6 by bugdroid1@chromium.org, Dec 11

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/58e6d60884950afe8e8383741a742eca4cd96b91

commit 58e6d60884950afe8e8383741a742eca4cd96b91
Author: Yannis Guyon <yguyon@google.com>
Date: Tue Dec 11 18:21:47 2018

third_party/libwebp/fuzzing: Disable ExtractAndCropOrScale()

WEBP_REDUCE_SIZE is defined in chromium, disabling WebPPictureCrop()
and WebPPictureRescale(), crashing ExtractAndCropOrScale() in fuzz.h.
Disable ExtractAndCropOrScale() without returning an error when
WEBP_REDUCE_SIZE is defined.

BUG= chromium:912455 

Change-Id: I10f66de59498f664d7e0603cfd10698fa3f5f114
Reviewed-on: https://chromium-review.googlesource.com/c/1368108
Commit-Queue: Yannis Guyon <yguyon@google.com>
Reviewed-by: James Zern <jzern@google.com>
Cr-Commit-Position: refs/heads/master@{#615594}
[modify] https://crrev.com/58e6d60884950afe8e8383741a742eca4cd96b91/third_party/libwebp/fuzzing/fuzz.h

Status: Fixed (was: Assigned)
Project Member

Comment 8 by ClusterFuzz, Dec 12

ClusterFuzz has detected this issue as fixed in range 615591:615600.

Detailed report: https://clusterfuzz.com/testcase?key=6069550178893824

Fuzzer: libFuzzer_libwebp_enc_dec_api_fuzzer
Fuzz target binary: libwebp_enc_dec_api_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x053900281e9e
Crash State:
  fuzz_webp_enc_dec.cc
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=614208:614220
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=615591:615600

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6069550178893824

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Dec 12

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 6069550178893824 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment