Automatically applying components based on crash stacktrace and information from OWNERS files.
If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/e3140a8f27345d395ea75fe619d730951a438e89 (Run SQLite DBFuzz2 on ClusterFuzz to fuzz for data corruption).
If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Richard and Dan, could you please look into this bug? Thank you very much!
Stack trace:
==2006964==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x7fa341743380 in sqlite3VdbeRecordCompareWithSkip third_party/sqlite/amalgamation/sqlite3.c:80072:12
#1 0x7fa3417218b7 in sqlite3BtreeMovetoUnpacked third_party/sqlite/amalgamation/sqlite3.c:0:15
#2 0x7fa341724e89 in sqlite3BtreeInsert third_party/sqlite/amalgamation/sqlite3.c:71449:14
#3 0x7fa341701c33 in sqlite3VdbeExec third_party/sqlite/amalgamation/sqlite3.c:88380:10
#4 0x7fa341639ccc in sqlite3Step third_party/sqlite/amalgamation/sqlite3.c:81415:10
#5 0x7fa3416263ee in chrome_sqlite3_step third_party/sqlite/amalgamation/sqlite3.c:81478:16
#6 0x7fa34164c021 in chrome_sqlite3_exec third_party/sqlite/amalgamation/sqlite3.c:118058:12
#7 0x55e6416d9c89 in LLVMFuzzerTestOneInput third_party/sqlite/src/test/dbfuzz2.c:97:5
The test case is attached.
Thanks Victor. Richard and Dan, since this a dbfuzz2 bug it should be able to reproduce with your normal dbfuzz2 fuzzer (this isn't an LPM fuzzer test case).
I thought I had responded to this already, but apparently I failed to press "Save changes" or something...
Despite much effort, we have been unable to reproduce this problem in any version of SQLite. However, another use-of-uninitialized-value problem with a similar stack trace was fixed by https://www.sqlite.org/src/info/fa47f4c6589c431c, so perhaps that same check-in will fix this one too.
Thank you very much for looking into this so quickly! I am backporting the check-in above. We'll see if clusterfuzz marks this fixed after the change lands.
ClusterFuzz testcase 5810796468371456 is verified as fixed, so closing issue as verified.
If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
ClusterFuzz testcase 6037613934542848 is still reproducing on tip-of-tree build (trunk).
Please re-test your fix against this testcase and if the fix was incorrect or incomplete, please re-open the bug. Otherwise, ignore this notification and add ClusterFuzz-Wrong label.
Comment 1 by ClusterFuzz
, Dec 14Labels: Test-Predator-Auto-Components