New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 624347 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Email to this user bounced
Closed: May 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Integer-overflow in SkIRect::makeOutset

Project Member Reported by ClusterFuzz, Jun 29 2016

Issue description

Comment 1 by mmoroz@chromium.org, Jun 29 2016

Cc: mmoroz@chromium.org kcc@chromium.org aizatsky@chromium.org
Components: Internals>Skia
Owner: reed@chromium.org
Project Member

Comment 2 by ClusterFuzz, Jul 6 2016

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4692788231012352

Fuzzer: libfuzzer_skia_path_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  SkIRect::makeOutset
  void hair_path<
  SkDraw::drawDevPath
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=400437:400524

Minimized Testcase (0.04 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95Gx-FIimd_t80XR70_5Si-3LgLPFn1JrmuTFnvl50nd_qeW_sjy6mApJrEjTqeu_fYAvL-U0TCabtdR60ryzrRizbrOmwPP3MWnADjfJ43ZBzifogBQI7Ptp0s8VNrky44dHu4sVXUB5YZg96PNlLkab1Vog?testcase_id=4692788231012352

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 3 by ClusterFuzz, Jul 14 2016

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5190524906766336

Fuzzer: libfuzzer_skia_path_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  SkIRect::makeOutset
  void hair_path<
  SkDraw::drawDevPath
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=400437:400524

Minimized Testcase (0.04 Kb): https://cluster-fuzz.appspot.com/download/AMIfv953CXb93NW17P4rZSdUS4quv2unKZ5dR8_qAIB78Aj4gWDvFXVWjjrsxuuxLO_VzGPx2KkLYTmHO8mBnWQfzFxmrRrxZVa3PID_ckZZjRnSmmkhLR9jgtQ-Ix-woNd3wonfG90Cc7a0SPS2L_cPr3Z2sdbXKw?testcase_id=5190524906766336

Filer: brajkumar

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
Project Member

Comment 4 by ClusterFuzz, Aug 25 2016

ClusterFuzz has detected this issue as fixed in range 413961:414068.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5190524906766336

Fuzzer: libfuzzer_skia_path_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  SkIRect::makeOutset
  void hair_path<
  SkDraw::drawDevPath
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=400437:400524
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=413961:414068

Minimized Testcase (0.04 Kb): https://cluster-fuzz.appspot.com/download/AMIfv953CXb93NW17P4rZSdUS4quv2unKZ5dR8_qAIB78Aj4gWDvFXVWjjrsxuuxLO_VzGPx2KkLYTmHO8mBnWQfzFxmrRrxZVa3PID_ckZZjRnSmmkhLR9jgtQ-Ix-woNd3wonfG90Cc7a0SPS2L_cPr3Z2sdbXKw?testcase_id=5190524906766336

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Aug 25 2016

Labels: ClusterFuzz-Verified
Status: Verified (was: Available)
ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Labels: ClusterFuzz-Wrong
Status: Assigned (was: Verified)
Re-Opening the issue as Clusterfuzz has detected the crash again, Clusterfuzz update in the next comment.Thank you 
Project Member

Comment 7 by ClusterFuzz, Sep 8 2016

Project Member

Comment 8 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Status: WontFix (was: Assigned)
Bulk-WontFixing these bugs. This was a bug on ClusterFuzz side, see bug 717534. We will start seeing new testcases auto-filed in a day or two. We can't leave these open as ClusterFuzz won't autoverify them after ClusterFuzz-Wrong label.
Project Member

Comment 10 by ClusterFuzz, Jul 14 2017

Labels: Needs-Feedback
ClusterFuzz testcase 6507812937269248 is still reproducing on tip-of-tree build (trunk).

If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase.

Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace.
Labels: -ClusterFuzz-Wrong
We have made a bunch of changes on ClusterFuzz side, so resetting ClusterFuzz-Wrong label.

Sign in to add a comment