Abrt in imageloader::HelperProcessReceiver::HandleCommand |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6328430937374720 Project: chromeos Fuzzer: libFuzzer_chromeos_imageloader_helper_process_receiver_fuzzer Fuzz target binary: imageloader_helper_process_receiver_fuzzer Job Type: libfuzzer_asan_chromeos Platform Id: linux Crash Type: Abrt Crash Address: 0x000000000001 Crash State: imageloader::HelperProcessReceiver::HandleCommand imageloader::HelperProcessReceiver::OnFileCanReadWithoutBlocking imageloader::helper_process_receiver_fuzzer_run Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_asan_chromeos&range=3138110:3138341 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6328430937374720 Issue filed automatically. See https://chromium.googlesource.com/chromiumos/docs/+/master/fuzzing.md#Reproducing-crashes-from-ClusterFuzz for instructions to reproduce this bug locally.
,
Today
(10 hours ago)
I think this is an assert statement crashing on bad input.
,
Today
(10 hours ago)
Agree. It's caused by LOG(FATAL). Marking this as Won't fix.
,
Today
(10 hours ago)
If you take a look at this fuzzer's stats: https://clusterfuzz.com/fuzzer-stats/by-day/date-start/2019-01-15/date-end/2019-01-21/fuzzer/libFuzzer_chromeos_imageloader_helper_process_receiver_fuzzer/job/libfuzzer_asan_chromeos you can see that regular_crash_percent is 100% and fuzzing_time_percent is 0%, meaning that fuzzing is basically not happening because the fuzzer will crash immediately on every fuzzing run. Unless that is fixed the fuzzer isn't really useful.
,
Today
(9 hours ago)
Do we have proper support for libprotobuf-mutator in chrome os? We plan to use this in imageloader so we can skip this type of crash. see crbug.com/904593
,
Today
(9 hours ago)
We have support, but I'm not what you mean by "proper" if you mean can it use protos that are optimized for the LITE_RUNTIME then I'm not sure. +allenwebb do you know the answer to this?
,
Today
(9 hours ago)
Sorry for my vague description. Yes, LITE_RUNTIME is what we need for imageloader (and some other system service protobufs).
,
Today
(8 hours ago)
libprotobuf-mutator will never support LITE_RUNTIME. What is in the works is getting the --cpp_out=speed:... feature included into Chrome OS with support for platform packages using GN to override the "option optimize_for = LITE_RUNTIME;" when building fuzzers. This is blocked by upreving protobuf which is blocked by a bug in the python eclasses. |
||||
►
Sign in to add a comment |
||||
Comment 1 by ClusterFuzz
, Yesterday (35 hours ago)Labels: ClusterFuzz-Auto-CC