New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 913960 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Dec 17
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Chrome
Pri: 1
Type: Bug

Blocking:
issue 913962



Sign in to add a comment

Timeout in pdfium_xfa_fuzzer

Project Member Reported by ClusterFuzz, Dec 11

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6302888739209216

Fuzzer: libFuzzer_pdfium_xfa_fuzzer
Fuzz target binary: pdfium_xfa_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Timeout (exceeds 25 secs)
Crash Address: 
Crash State:
  pdfium_xfa_fuzzer
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=612547:612554

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6302888739209216

Issue manually filed by: mmoroz

See https://github.com/google/clusterfuzz-tools for more information.
 
Blocking: 913962
Project Member

Comment 2 by ClusterFuzz, Dec 11

Cc: tsepez@chromium.org thestig@chromium.org weili@chromium.org jam@chromium.org caryclark@google.com
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Cc: kkaluri@chromium.org
Labels: M-73 Test-Predator-Wrong CF-NeedsTriage
Unable to provide possible suspect using Predator, CL and Code Search.
Could someone please look into the issue.

Thank You...

Project Member

Comment 4 by ClusterFuzz, Dec 13

Labels: OS-Windows
Components: Internals>Plugins>PDF
Owner: thestig@chromium.org
Status: Assigned (was: Untriaged)
I bumped up kMaxObjectNumber and now there can exist bigger xref tables.
Project Member

Comment 6 by ClusterFuzz, Dec 15

Labels: OS-Chrome
Project Member

Comment 7 by bugdroid1@chromium.org, Dec 17

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/902c20e39cc2a6bc29c100283723d87a1a05785a

commit 902c20e39cc2a6bc29c100283723d87a1a05785a
Author: Lei Zhang <thestig@chromium.org>
Date: Mon Dec 17 18:18:39 2018

Check for bad values of startxref.

The startxref value should not point into the PDF file header.

BUG= chromium:913960 

Change-Id: Id1bcf9c0dafa8853f2dda5564e8b5d6407fe4bd8
Reviewed-on: https://pdfium-review.googlesource.com/c/47351
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

[modify] https://crrev.com/902c20e39cc2a6bc29c100283723d87a1a05785a/core/fpdfapi/parser/cpdf_parser_unittest.cpp
[modify] https://crrev.com/902c20e39cc2a6bc29c100283723d87a1a05785a/core/fpdfapi/parser/cpdf_parser.cpp
[modify] https://crrev.com/902c20e39cc2a6bc29c100283723d87a1a05785a/core/fpdfapi/parser/cpdf_parser.h

Status: Fixed (was: Assigned)
Project Member

Comment 9 by bugdroid1@chromium.org, Dec 17

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/fc4d619460391fd00d584172d754dc0b36dd1a01

commit fc4d619460391fd00d584172d754dc0b36dd1a01
Author: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Date: Mon Dec 17 20:21:21 2018

Roll src/third_party/pdfium a0c36804be26..902c20e39cc2 (1 commits)

https://pdfium.googlesource.com/pdfium.git/+log/a0c36804be26..902c20e39cc2


git log a0c36804be26..902c20e39cc2 --date=short --no-merges --format='%ad %ae %s'
2018-12-17 thestig@chromium.org Check for bad values of startxref.


Created with:
  gclient setdep -r src/third_party/pdfium@902c20e39cc2

The AutoRoll server is located here: https://autoroll.skia.org/r/pdfium-autoroll

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.



BUG= chromium:913960 
TBR=dsinclair@chromium.org

Change-Id: I16e2b7f353f4040fbca8db405c415f42a2df23e5
Reviewed-on: https://chromium-review.googlesource.com/c/1380352
Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#617208}
[modify] https://crrev.com/fc4d619460391fd00d584172d754dc0b36dd1a01/DEPS

Project Member

Comment 10 by ClusterFuzz, Dec 18

ClusterFuzz has detected this issue as fixed in range 617205:617208.

Detailed report: https://clusterfuzz.com/testcase?key=6302888739209216

Fuzzer: libFuzzer_pdfium_xfa_fuzzer
Fuzz target binary: pdfium_xfa_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Timeout (exceeds 25 secs)
Crash Address: 
Crash State:
  pdfium_xfa_fuzzer
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=612547:612554
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=617205:617208

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6302888739209216

See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by ClusterFuzz, Dec 18

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 6302888739209216 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment