The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ca857e0b1ee85aaaf8882f0eb5b5c32ea8fae45b

commit ca857e0b1ee85aaaf8882f0eb5b5c32ea8fae45b
Author: reillyg <reillyg@chromium.org>
Date: Fri May 20 22:20:52 2016

UBSAN: Fix left-shifts of negative values in webusb_descriptors.cc.

ClusterFuzz found that OnReadWebUsbAllowedOriginsHeader and
OnReadBosDescriptorHeader will left-shift the char* returned by
IOBuffer::data() which is undefined if the value is negative. This
pointer should be cast to a uint8_t* before being dereferenced.

BUG= 613693 

Review-Url: https://codereview.chromium.org/1999083003
Cr-Commit-Position: refs/heads/master@{#395181}

[modify] https://crrev.com/ca857e0b1ee85aaaf8882f0eb5b5c32ea8fae45b/device/usb/webusb_descriptors.cc

ClusterFuzz has detected this issue as fixed in range 395128:395223.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4865781469020160

Fuzzer: libfuzzer_webusb_descriptors_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  device::OnReadBosDescriptorHeader
  void base::internal::RunnableAdapter<void
  MakeItSo<const scoped_refptr<device::UsbDeviceHandle> &, const base::Callback<vo
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=394495:394622
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=395128:395223

Minimized Testcase (0.16 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97LOw8TMkdZMbgWu5hZ_GJt5d2YfFyhAJnxzi9yWUhuALWravLvLueNpY4K-aHYKHN5VHoLbI9Ofs10faM7Z0KkcDmxPv0s6X9hJn5lkEWtTcjWFvrzvVOb73M0cGRpauFn8QPBTqjA8mozQauJIJDWQBqJ2g

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot