New issue
Advanced search Search tips

Issue 917320 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Jan 17
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

ASSERT: 0

Project Member Reported by ClusterFuzz, Dec 21

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5673051177615360

Fuzzer: libFuzzer_sqlite3_dbfuzz2_fuzzer
Fuzz target binary: sqlite3_dbfuzz2_fuzzer
Job Type: x86_libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  0
  balance_quick
  balance
  
Sanitizer: address (ASAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5673051177615360

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.
 
Project Member

Comment 1 by ClusterFuzz, Dec 21

Cc: pwnall@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Cc: pnangunoori@chromium.org
Labels: M-72 Test-Predator-Wrong CF-NeedsTriage
Unable to provide possible suspect using Predator, CL and Code Search.
Could someone please look into the issue.
Thank You.
Cc: -pwnall@chromium.org drhsql...@gmail.com danielk1...@gmail.com
Components: Internals>Storage
Owner: pwnall@chromium.org
Status: Assigned (was: Untriaged)
Richard and Dan, could you please take a look? I'm not 100% sure this bug is valid, so please disregard if you can't repro.

dbfuzz2 test case attached. Stack trace below.

sqlite3_dbfuzz2_fuzzer: ../../third_party/sqlite/amalgamation/sqlite3.c:70074: int balance_quick(MemPage *, MemPage *, u8 *): Assertion `0' failed.
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2497893==ERROR: AddressSanitizer: ABRT on unknown address 0x00261d65 (pc 0xf7f51f39 bp 0xffa73088 sp 0xffa72c08 T0)
SCARINESS: 10 (signal)
LLVMSymbolizer: error reading file: No such file or directory
    #4 0xf7167d8a in __assert_fail (/lib/i386-linux-gnu/libc.so.6+0x24d8a)
    #5 0xf7a875f1 in balance_quick third_party/sqlite/amalgamation/sqlite3.c:70074:7
    #6 0xf7a7a621 in balance third_party/sqlite/amalgamation/sqlite3.c:71170:16
    #7 0xf7a2cfb9 in sqlite3BtreeInsert third_party/sqlite/amalgamation/sqlite3.c:71567:10
    #8 0xf79defaf in sqlite3VdbeExec third_party/sqlite/amalgamation/sqlite3.c:87694:8
    #9 0xf787845b in sqlite3Step third_party/sqlite/amalgamation/sqlite3.c:81427:10
    #10 0xf7855f94 in sqlite3_step third_party/sqlite/amalgamation/sqlite3.c:81490:16
    #11 0xf7892170 in sqlite3_exec third_party/sqlite/amalgamation/sqlite3.c:118075:12
    #12 0x56683bb5 in LLVMFuzzerTestOneInput third_party/sqlite/src/test/dbfuzz2.c:95:5
clusterfuzz-testcase-minimized-sqlite3_dbfuzz2_fuzzer-5673051177615360
1.0 KB View Download
Cc: mpdenton@chromium.org
This is valid, I was able to reproduce it locally once I enabled assertions.
Project Member

Comment 5 by ClusterFuzz, Jan 17 (5 days ago)

ClusterFuzz has detected this issue as fixed in range 623523:623544.

Detailed report: https://clusterfuzz.com/testcase?key=5673051177615360

Fuzzer: libFuzzer_sqlite3_dbfuzz2_fuzzer
Fuzz target binary: sqlite3_dbfuzz2_fuzzer
Job Type: x86_libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  0
  balance_quick
  balance
  
Sanitizer: address (ASAN)

Fixed: https://clusterfuzz.com/revisions?job=x86_libfuzzer_chrome_asan_debug&range=623523:623544

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5673051177615360

See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Jan 17 (5 days ago)

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5673051177615360 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment