New issue
Advanced search Search tips

Issue 919018 link

Starred by 2 users

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Chrome , Mac
Pri: 1
Type: Bug



Sign in to add a comment

Abrt in sfntly::BitmapSizeTable::Builder::Initialize

Project Member Reported by ClusterFuzz, Jan 4

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5650985506308096

Fuzzer: libFuzzer_sfntly_fuzzer
Fuzz target binary: sfntly_fuzzer
Job Type: mac_libfuzzer_chrome_asan
Platform Id: mac

Crash Type: Abrt
Crash Address: 0x7fff969cef06
Crash State:
  /usr/lib/libc++abi.dylib:x86_64
  /usr/lib/libc++abi.dylib:x86_64
  _objc_terminate
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=474780:474843

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5650985506308096

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for instructions to reproduce this bug locally.
 
Project Member

Comment 1 by ClusterFuzz, Jan 4

Cc: thestig@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Cc: rsesek@chromium.org kkaluri@chromium.org
Labels: M-72 Test-Predator-Wrong CF-NeedsTriage
Unable to provide possible suspect using Predator, CL and Code Search.
With reference to the  Issue 895135 , CC'ing for rsesek@ for further triage.

Thank You...

Cc: -rsesek@chromium.org js...@chromium.org behdad@chromium.org
Components: Blink>Fonts
Summary: Abrt in sfntly::BitmapSizeTable::Builder::Initialize (was: Abrt in /usr/lib/libc++abi.dylib:x86_64)
Not related to  issue 895135  at all.

==72903==ERROR: AddressSanitizer: ABRT on unknown address 0x7fff94fbaf06 (pc 0x7fff94fbaf06 bp 0x7fff54e62cd0 sp 0x7fff54e62ca8 T0)
SCARINESS: 10 (signal)
    #0 0x7fff94fbaf05 in __pthread_kill
    #1 0x7fff96fce6de in abort
    #2 0x7fff8a238c10  (/usr/lib/libc++abi.dylib:x86_64+0xc10)
    #3 0x7fff8a25edfe  (/usr/lib/libc++abi.dylib:x86_64+0x26dfe)
    #2 0x7fff8d04b4a5 in _objc_terminate()
    #5 0x7fff8a25c00d  (/usr/lib/libc++abi.dylib:x86_64+0x2400d)
    #6 0x7fff8a25ba79  (/usr/lib/libc++abi.dylib:x86_64+0x23a79)
    #7 0x7fff9b35c726  (/usr/lib/libc++.1.dylib:x86_64+0x3a726)
    #3 0x10af25397 in std::__1::vector<sfntly::Ptr<sfntly::IndexSubTable::Builder>, std::__1::allocator<sfntly::Ptr<sfntly::IndexSubTable::Builder> > >::__recommend(unsigned long) const third_party/llvm-build/Release+Asserts/include/c++/v1/vector:1010:15
    #4 0x10af24ed0 in std::__1::vector<sfntly::Ptr<sfntly::IndexSubTable::Builder>, std::__1::allocator<sfntly::Ptr<sfntly::IndexSubTable::Builder> > >::__append(unsigned long) third_party/llvm-build/Release+Asserts/include/c++/v1/vector:1087:57
    #5 0x10af1fd16 in sfntly::BitmapSizeTable::Builder::Initialize(sfntly::ReadableFontData*) third_party/sfntly/src/cpp/src/sfntly/table/bitmap/bitmap_size_table.cc:465:23
    #6 0x10af1e5e8 in sfntly::BitmapSizeTable::Builder::GetIndexSubTableBuilders() third_party/sfntly/src/cpp/src/sfntly/table/bitmap/bitmap_size_table.cc:454:5
    #7 0x10ae1c49c in (anonymous namespace)::InitializeBitmapBuilder(sfntly::EbdtTable::Builder*, sfntly::EblcTable::Builder*, std::__1::set<int, std::__1::less<int>, std::__1::allocator<int> > const&) third_party/sfntly/src/cpp/src/sample/chromium/subsetter_impl.cc:324:24
    #8 0x10ae1b933 in sfntly::SetupBitmapBuilders(sfntly::Font*, sfntly::Font::Builder*, std::__1::set<int, std::__1::less<int>, std::__1::allocator<int> > const&) third_party/sfntly/src/cpp/src/sample/chromium/subsetter_impl.cc:607:8
    #9 0x10ae1f3ba in sfntly::SubsetterImpl::Subset(std::__1::set<int, std::__1::less<int>, std::__1::allocator<int> > const&, sfntly::GlyphTable*, sfntly::LocaTable*) third_party/sfntly/src/cpp/src/sample/chromium/subsetter_impl.cc:776:22
    #10 0x10ae1df2c in sfntly::SubsetterImpl::SubsetFont(unsigned int const*, unsigned long, unsigned char**) third_party/sfntly/src/cpp/src/sample/chromium/subsetter_impl.cc:685:19
    #11 0x10ae1aaae in SfntlyWrapper::SubsetFont(char const*, unsigned char const*, unsigned long, unsigned int const*, unsigned long, unsigned char**) third_party/sfntly/src/cpp/src/sample/chromium/font_subsetter.cc:38:20
    #12 0x10ad9b82f in LLVMFuzzerTestOneInput third_party/sfntly/fuzzers/subset_font_fuzzer.cc:35:3
    #13 0x10add1a4a in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:571:15
    #14 0x10adaab56 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:280:6
    #15 0x10adaf796 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:713:9
    #16 0x10adeff31 in main third_party/libFuzzer/src/FuzzerMain.cpp:20:10
    #17 0x7fff8ed0a5ac in start
Cc: drott@chromium.org e...@chromium.org
Components: -Blink>Fonts Internals>Skia>PDF
Owner: thestig@chromium.org
Status: Assigned (was: Untriaged)
Project Member

Comment 6 by ClusterFuzz, Jan 8

Labels: OS-Linux
Project Member

Comment 7 by ClusterFuzz, Jan 8

Detailed report: https://clusterfuzz.com/testcase?key=5650985506308096

Fuzzer: libFuzzer_sfntly_fuzzer
Fuzz target binary: sfntly_fuzzer
Job Type: mac_libfuzzer_chrome_asan
Platform Id: mac

Crash Type: Abrt
Crash Address: 0x7fff8b950f06
Crash State:
  sfntly::BitmapSizeTable::Builder::Initialize
  sfntly::BitmapSizeTable::Builder::GetIndexSubTableBuilders
  InitializeBitmapBuilder
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=474780:474843

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5650985506308096

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for instructions to reproduce this bug locally.
Project Member

Comment 8 by ClusterFuzz, Jan 9

Labels: OS-Chrome

Sign in to add a comment