New issue
Advanced search Search tips

Issue 923921 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner: ----
Closed: Today
Cc:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 1
Type: Bug



Sign in to add a comment

Abrt in imageloader::HelperProcessReceiver::HandleCommand

Project Member Reported by ClusterFuzz, Yesterday (35 hours ago)

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6328430937374720

Project: chromeos
Fuzzer: libFuzzer_chromeos_imageloader_helper_process_receiver_fuzzer
Fuzz target binary: imageloader_helper_process_receiver_fuzzer
Job Type: libfuzzer_asan_chromeos
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x000000000001
Crash State:
  imageloader::HelperProcessReceiver::HandleCommand
  imageloader::HelperProcessReceiver::OnFileCanReadWithoutBlocking
  imageloader::helper_process_receiver_fuzzer_run
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_asan_chromeos&range=3138110:3138341

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6328430937374720

Issue filed automatically.

See https://chromium.googlesource.com/chromiumos/docs/+/master/fuzzing.md#Reproducing-crashes-from-ClusterFuzz for instructions to reproduce this bug locally.
 
Project Member

Comment 1 by ClusterFuzz, Yesterday (35 hours ago)

Cc: kerrnel@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.

Comment 2 by kerrnel@chromium.org, Today (10 hours ago)

Cc: xiaochu@chromium.org
I think this is an assert statement crashing on bad input.

Comment 3 by xiaochu@chromium.org, Today (10 hours ago)

Status: WontFix (was: Untriaged)
Agree. It's caused by LOG(FATAL). Marking this as Won't fix.

Comment 4 by metzman@chromium.org, Today (10 hours ago)

If you take a look at this fuzzer's stats: https://clusterfuzz.com/fuzzer-stats/by-day/date-start/2019-01-15/date-end/2019-01-21/fuzzer/libFuzzer_chromeos_imageloader_helper_process_receiver_fuzzer/job/libfuzzer_asan_chromeos

you can see that regular_crash_percent is 100% and fuzzing_time_percent is 0%, meaning that fuzzing is basically not happening because the fuzzer will crash immediately on every fuzzing run.

Unless that is fixed the fuzzer isn't really useful.

Comment 5 by xiaochu@chromium.org, Today (9 hours ago)

Do we have proper support for libprotobuf-mutator in chrome os? We plan to use this in imageloader so we can skip this type of crash. see crbug.com/904593

Comment 6 by metzman@chromium.org, Today (9 hours ago)

Cc: allenwebb@chromium.org
We have support, but I'm not what you mean by "proper" if you mean can it use protos that are optimized for the LITE_RUNTIME then I'm not sure. 
+allenwebb do you know the answer to this?

Comment 7 by xiaochu@chromium.org, Today (9 hours ago)

Sorry for my vague description. Yes, LITE_RUNTIME is what we need for imageloader (and some other system service protobufs).

Comment 8 by allenwebb@google.com, Today (8 hours ago)

libprotobuf-mutator will never support LITE_RUNTIME. What is in the works is getting the --cpp_out=speed:... feature included into Chrome OS with support for platform packages using GN to override the "option optimize_for = LITE_RUNTIME;" when building fuzzers. This is blocked by upreving protobuf which is blocked by a bug in the python eclasses.

Sign in to add a comment