Integer-overflow in SkIRect::makeOutset |
|||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=4692788231012352 Fuzzer: libfuzzer_skia_path_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: SkIRect::makeOutset void hair_path< SkDraw::drawDevPath Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=400437:400524 Minimized Testcase (0.04 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95Gx-FIimd_t80XR70_5Si-3LgLPFn1JrmuTFnvl50nd_qeW_sjy6mApJrEjTqeu_fYAvL-U0TCabtdR60ryzrRizbrOmwPP3MWnADjfJ43ZBzifogBQI7Ptp0s8VNrky44dHu4sVXUB5YZg96PNlLkab1Vog?testcase_id=4692788231012352 Filer: mmoroz See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Jul 6 2016
ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4692788231012352 Fuzzer: libfuzzer_skia_path_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: SkIRect::makeOutset void hair_path< SkDraw::drawDevPath Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=400437:400524 Minimized Testcase (0.04 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95Gx-FIimd_t80XR70_5Si-3LgLPFn1JrmuTFnvl50nd_qeW_sjy6mApJrEjTqeu_fYAvL-U0TCabtdR60ryzrRizbrOmwPP3MWnADjfJ43ZBzifogBQI7Ptp0s8VNrky44dHu4sVXUB5YZg96PNlLkab1Vog?testcase_id=4692788231012352 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jul 14 2016
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5190524906766336 Fuzzer: libfuzzer_skia_path_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: SkIRect::makeOutset void hair_path< SkDraw::drawDevPath Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=400437:400524 Minimized Testcase (0.04 Kb): https://cluster-fuzz.appspot.com/download/AMIfv953CXb93NW17P4rZSdUS4quv2unKZ5dR8_qAIB78Aj4gWDvFXVWjjrsxuuxLO_VzGPx2KkLYTmHO8mBnWQfzFxmrRrxZVa3PID_ckZZjRnSmmkhLR9jgtQ-Ix-woNd3wonfG90Cc7a0SPS2L_cPr3Z2sdbXKw?testcase_id=5190524906766336 Filer: brajkumar See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Aug 25 2016
ClusterFuzz has detected this issue as fixed in range 413961:414068. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5190524906766336 Fuzzer: libfuzzer_skia_path_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: SkIRect::makeOutset void hair_path< SkDraw::drawDevPath Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=400437:400524 Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=413961:414068 Minimized Testcase (0.04 Kb): https://cluster-fuzz.appspot.com/download/AMIfv953CXb93NW17P4rZSdUS4quv2unKZ5dR8_qAIB78Aj4gWDvFXVWjjrsxuuxLO_VzGPx2KkLYTmHO8mBnWQfzFxmrRrxZVa3PID_ckZZjRnSmmkhLR9jgtQ-Ix-woNd3wonfG90Cc7a0SPS2L_cPr3Z2sdbXKw?testcase_id=5190524906766336 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Aug 25 2016
ClusterFuzz testcase is verified as fixed, closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Sep 8 2016
Re-Opening the issue as Clusterfuzz has detected the crash again, Clusterfuzz update in the next comment.Thank you
,
Sep 8 2016
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6507812937269248 Fuzzer: libfuzzer_skia_path_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: SkIRect::makeOutset void hair_path< SkDraw::drawDevPath Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=400437:400524 Minimized Testcase (0.04 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94e19nRLDT4zdz22pWup_WDMr6zeeFqDW8NwboRO1rRa94n04cf6H1qhiBhL05qkX6TfrfXWNNIYkwRmvwTdyv9xOe_LLWbDh5kPIIQG5udaNMN1BYJVlrlOPsrIj8qAgT_hbizwAjjJEEHbedBdd9YiLR8Qg?testcase_id=6507812937269248 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
May 2 2017
Bulk-WontFixing these bugs. This was a bug on ClusterFuzz side, see bug 717534. We will start seeing new testcases auto-filed in a day or two. We can't leave these open as ClusterFuzz won't autoverify them after ClusterFuzz-Wrong label.
,
Jul 14 2017
ClusterFuzz testcase 6507812937269248 is still reproducing on tip-of-tree build (trunk). If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase. Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace.
,
Sep 18 2017
We have made a bunch of changes on ClusterFuzz side, so resetting ClusterFuzz-Wrong label. |
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by mmoroz@chromium.org
, Jun 29 2016Components: Internals>Skia
Owner: reed@chromium.org