Abrt in sfntly::BitmapSizeTable::Builder::Initialize |
|||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5650985506308096 Fuzzer: libFuzzer_sfntly_fuzzer Fuzz target binary: sfntly_fuzzer Job Type: mac_libfuzzer_chrome_asan Platform Id: mac Crash Type: Abrt Crash Address: 0x7fff969cef06 Crash State: /usr/lib/libc++abi.dylib:x86_64 /usr/lib/libc++abi.dylib:x86_64 _objc_terminate Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=474780:474843 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5650985506308096 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for instructions to reproduce this bug locally.
,
Jan 4
Unable to provide possible suspect using Predator, CL and Code Search. With reference to the Issue 895135 , CC'ing for rsesek@ for further triage. Thank You...
,
Jan 4
Not related to issue 895135 at all. ==72903==ERROR: AddressSanitizer: ABRT on unknown address 0x7fff94fbaf06 (pc 0x7fff94fbaf06 bp 0x7fff54e62cd0 sp 0x7fff54e62ca8 T0) SCARINESS: 10 (signal) #0 0x7fff94fbaf05 in __pthread_kill #1 0x7fff96fce6de in abort #2 0x7fff8a238c10 (/usr/lib/libc++abi.dylib:x86_64+0xc10) #3 0x7fff8a25edfe (/usr/lib/libc++abi.dylib:x86_64+0x26dfe) #2 0x7fff8d04b4a5 in _objc_terminate() #5 0x7fff8a25c00d (/usr/lib/libc++abi.dylib:x86_64+0x2400d) #6 0x7fff8a25ba79 (/usr/lib/libc++abi.dylib:x86_64+0x23a79) #7 0x7fff9b35c726 (/usr/lib/libc++.1.dylib:x86_64+0x3a726) #3 0x10af25397 in std::__1::vector<sfntly::Ptr<sfntly::IndexSubTable::Builder>, std::__1::allocator<sfntly::Ptr<sfntly::IndexSubTable::Builder> > >::__recommend(unsigned long) const third_party/llvm-build/Release+Asserts/include/c++/v1/vector:1010:15 #4 0x10af24ed0 in std::__1::vector<sfntly::Ptr<sfntly::IndexSubTable::Builder>, std::__1::allocator<sfntly::Ptr<sfntly::IndexSubTable::Builder> > >::__append(unsigned long) third_party/llvm-build/Release+Asserts/include/c++/v1/vector:1087:57 #5 0x10af1fd16 in sfntly::BitmapSizeTable::Builder::Initialize(sfntly::ReadableFontData*) third_party/sfntly/src/cpp/src/sfntly/table/bitmap/bitmap_size_table.cc:465:23 #6 0x10af1e5e8 in sfntly::BitmapSizeTable::Builder::GetIndexSubTableBuilders() third_party/sfntly/src/cpp/src/sfntly/table/bitmap/bitmap_size_table.cc:454:5 #7 0x10ae1c49c in (anonymous namespace)::InitializeBitmapBuilder(sfntly::EbdtTable::Builder*, sfntly::EblcTable::Builder*, std::__1::set<int, std::__1::less<int>, std::__1::allocator<int> > const&) third_party/sfntly/src/cpp/src/sample/chromium/subsetter_impl.cc:324:24 #8 0x10ae1b933 in sfntly::SetupBitmapBuilders(sfntly::Font*, sfntly::Font::Builder*, std::__1::set<int, std::__1::less<int>, std::__1::allocator<int> > const&) third_party/sfntly/src/cpp/src/sample/chromium/subsetter_impl.cc:607:8 #9 0x10ae1f3ba in sfntly::SubsetterImpl::Subset(std::__1::set<int, std::__1::less<int>, std::__1::allocator<int> > const&, sfntly::GlyphTable*, sfntly::LocaTable*) third_party/sfntly/src/cpp/src/sample/chromium/subsetter_impl.cc:776:22 #10 0x10ae1df2c in sfntly::SubsetterImpl::SubsetFont(unsigned int const*, unsigned long, unsigned char**) third_party/sfntly/src/cpp/src/sample/chromium/subsetter_impl.cc:685:19 #11 0x10ae1aaae in SfntlyWrapper::SubsetFont(char const*, unsigned char const*, unsigned long, unsigned int const*, unsigned long, unsigned char**) third_party/sfntly/src/cpp/src/sample/chromium/font_subsetter.cc:38:20 #12 0x10ad9b82f in LLVMFuzzerTestOneInput third_party/sfntly/fuzzers/subset_font_fuzzer.cc:35:3 #13 0x10add1a4a in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:571:15 #14 0x10adaab56 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:280:6 #15 0x10adaf796 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:713:9 #16 0x10adeff31 in main third_party/libFuzzer/src/FuzzerMain.cpp:20:10 #17 0x7fff8ed0a5ac in start
,
Jan 4
,
Jan 7
,
Jan 8
,
Jan 8
Detailed report: https://clusterfuzz.com/testcase?key=5650985506308096 Fuzzer: libFuzzer_sfntly_fuzzer Fuzz target binary: sfntly_fuzzer Job Type: mac_libfuzzer_chrome_asan Platform Id: mac Crash Type: Abrt Crash Address: 0x7fff8b950f06 Crash State: sfntly::BitmapSizeTable::Builder::Initialize sfntly::BitmapSizeTable::Builder::GetIndexSubTableBuilders InitializeBitmapBuilder Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=474780:474843 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5650985506308096 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for instructions to reproduce this bug locally.
,
Jan 9
|
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by ClusterFuzz
, Jan 4Labels: ClusterFuzz-Auto-CC