MozillaSecurity / FuzzManager

A fuzzing management tools collection
Mozilla Public License 2.0
187 stars 48 forks source link

[CrashManager] UnicodeEncodeError thrown if stack contains unicode #279

Open nth10sd opened 7 years ago

nth10sd commented 7 years ago

Sample backtrace in gdb output:

backtrace

#0  0x0000000000833a40 in js::jit::TypeBarrierPolicy::adjustInputs (this=<optimized out>, alloc=..., def=0x7f16e739eaa0) at /home/ubuntu/trees/mozilla-central/js/src/jit/TypePolicy.cpp:302
#1  0x00000000006e37c5 in (anonymous namespace)::TypeAnalyzer::adjustInputs (def=0x7f16e739eaa0, this=0x7ffe134dd810) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonAnalysis.cpp:1686
#2  (anonymous namespace)::TypeAnalyzer::insertConversions (this=0x7ffe134dd810) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonAnalysis.cpp:1753
#3  (anonymous namespace)::TypeAnalyzer::analyze (this=0x7ffe134dd810) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonAnalysis.cpp:2000
#4  js::jit::ApplyTypeInformation (mir=mir@entry=0x7f16e738c2b0, graph=...) at /home/ubuntu/trees/mozilla-central/js/src/jit/IonAnalysis.cpp:2012
#5  0x00000000006ff477 in js::jit::OptimizeMIR (mir=mir@entry=0x7f16e738c2b0) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:1538
#6  0x0000000000700db5 in js::jit::CompileBackEnd (mir=mir@entry=0x7f16e738c2b0) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:1959
#7  0x0000000000433ac2 in js::jit::IonCompile (cx=cx@entry=0x7f16e8572000, script=<optimized out>, baselineFrame=baselineFrame@entry=0x7ffe134de038, osrPc=osrPc@entry=0x7f16e853dc0b "\343\201B\a\377\377\377d\346QQə\237\220\004\230\326\070\200", recompile=<optimized out>, optimizationLevel=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2247
#8  0x00000000007012ce in js::jit::Compile (cx=cx@entry=0x7f16e8572000, script=script@entry=..., osrFrame=osrFrame@entry=0x7ffe134de038, osrPc=osrPc@entry=0x7f16e853dc0b "\343\201B\a\377\377\377d\346QQə\237\220\004\230\326\070\200", forceRecompile=<optimized out>) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2440
#9  0x0000000000701c1b in BaselineCanEnterAtBranch (pc=0x7f16e853dc0b "\343\201B\a\377\377\377d\346QQə\237\220\004\230\326\070\200", osrFrame=0x7ffe134de038, script=..., cx=0x7f16e8572000) at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2631
#10 js::jit::IonCompileScriptForBaseline (cx=cx@entry=0x7f16e8572000, frame=frame@entry=0x7ffe134de038, pc=pc@entry=0x7f16e853dc0b "\343\201B\a\377\377\377d\346QQə\237\220\004\230\326\070\200") at /home/ubuntu/trees/mozilla-central/js/src/jit/Ion.cpp:2689
#11 0x00000000005ed996 in js::jit::DoWarmUpCounterFallbackOSR (cx=0x7f16e8572000, frame=0x7ffe134de038, stub=0x7f16e738b4a8, infoPtr=0x7ffe134ddfe8) at /home/ubuntu/trees/mozilla-central/js/src/jit/BaselineIC.cpp:145
#12 0x0000223131d3d691 in ?? ()
#13 0x0000000001ebecc0 in ?? ()
#14 0x00007ffe134ddfb0 in ?? ()
#15 0x0000000001ebf0e0 in ?? ()
#16 0x00007f16e777e8f8 in ?? ()
#17 0x0000223131d40af7 in ?? ()
#18 0x0000000000003022 in ?? ()
#19 0x00007ffe134de038 in ?? ()
#20 0x00007f16e738b4a8 in ?? ()
#21 0x00007ffe134ddfe8 in ?? ()
#22 0x0000000000000000 in ?? ()

Note that frame #9 has a unicode character 346QQə, and FuzzManager then throws. However, there is no indication that a bug was already filed, other than the appearance of a stack.

nth10sd commented 7 years ago

Trace:

Django Version: 1.7.1
Python Version: 2.7.6
Installed Applications:
('django.contrib.admin',
 'django.contrib.auth',
 'django.contrib.contenttypes',
 'django.contrib.sessions',
 'django.contrib.messages',
 'django.contrib.staticfiles',
 'ec2spotmanager',
 'crashmanager',
 'rest_framework',
 'rest_framework.authtoken',
 'chartjs',
 'debug_toolbar')
Installed Middleware:
('django.contrib.sessions.middleware.SessionMiddleware',
 'django.middleware.common.CommonMiddleware',
 'django.middleware.csrf.CsrfViewMiddleware',
 'django.contrib.auth.middleware.AuthenticationMiddleware',
 'django.contrib.auth.middleware.RemoteUserMiddleware',
 'django.contrib.messages.middleware.MessageMiddleware',
 'django.middleware.clickjacking.XFrameOptionsMiddleware',
 'server.settings.ExceptionLoggingMiddleware',
 'debug_toolbar.middleware.DebugToolbarMiddleware')

Traceback:
File "/usr/local/lib/python2.7/dist-packages/django/core/handlers/base.py" in get_response
  111.                     response = wrapped_callback(request, *callback_args, **callback_kwargs)
File "/usr/local/lib/python2.7/dist-packages/django/contrib/auth/decorators.py" in _wrapped_view
  22.                 return view_func(request, *args, **kwargs)
File "./crashmanager/views.py" in createExternalBug
  857.         extBugId = provider.getInstance().handlePOSTCreate(request, entry)
File "./crashmanager/Bugtracker/BugzillaProvider.py" in handlePOSTCreate
  286.             cRet = bz.addAttachment(ret["id"], crashdata_attach, "crash_data.txt", "Detailed Crash Information", is_binary=False)
File "./crashmanager/Bugtracker/BugzillaREST.py" in addAttachment
  176.         attachment["data"] = base64.b64encode(attachment["data"])
File "/usr/lib/python2.7/base64.py" in b64encode
  53.     encoded = binascii.b2a_base64(s)[:-1]

Exception Type: UnicodeEncodeError at /crashmanager/crashes/1082320/createbug/
Exception Value: 'ascii' codec can't encode character u'\u0259' in position 1691: ordinal not in range(128)
nth10sd commented 7 years ago

The bug will be filed successfully and the bucket created, but FuzzManager will throw the stack above, and the bucket will not have the bug assigned.

nth10sd commented 7 years ago

This happened during the filing a secure bug (not sure if it matters).