New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 626790 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Jul 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug-Security



Sign in to add a comment

Crash in blink::ComputeFloatOffsetForFloatLayoutAdapter<2>::heightRemaining

Project Member Reported by ClusterFuzz, Jul 8 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5723385007177728

Fuzzer: bj_broddelwerk
Job Type: windows_syzyasan_chrome
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x0052b673
Crash State:
  blink::ComputeFloatOffsetForFloatLayoutAdapter<2>::heightRemaining
  blink::FloatingObjects::logicalLeftOffsetForPositioningFloat
  blink::LayoutBlockFlow::computeLogicalLocationForFloat
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_chrome&range=403437:403457

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97HqOT98Z51QaySV-1Gxaq_WLY5Ghcp2OTdXqbCxHEHdCcT3pIItmN3gjlWSwyRPTZp2PXsiHEtVY-llmb-MB3K9u1CaNDr0pNOBWYQJCIcXTS4xTMa5E5LSPrSnYNilFLHLjYogSpIqHexDVFM2BR5CCLnCJvwgx3swaNwA0ekmIqc0ns?testcase_id=5723385007177728


Filer: ochang

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Project Member

Comment 1 by sheriffbot@chromium.org, Jul 9 2016

Labels: Pri-1
Cc: chrishtr@chromium.org yutak@chromium.org
Components: Blink>Layout

Comment 3 by yutak@chromium.org, Jul 11 2016

Cc: -yutak@chromium.org
Cc: -chrishtr@chromium.org
Status: Untriaged (was: Available)
Project Member

Comment 5 by sheriffbot@chromium.org, Jul 13 2016

Labels: M-53
Project Member

Comment 6 by sheriffbot@chromium.org, Jul 13 2016

Labels: ReleaseBlock-Beta
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 7 by e...@chromium.org, Jul 13 2016

Cc: shanmug...@samsung.com
The only Blink change in the regression range is c825d655f6aaf73484f9d56e9012793f5b9668cc which has an SVG change. Test case uses SVG so it's the likely culprit.

Comment 8 by e...@chromium.org, Jul 13 2016

Owner: e...@chromium.org
Status: Assigned (was: Untriaged)

Comment 10 by e...@chromium.org, Jul 13 2016

Status: Fixed (was: Assigned)
@eae,
  Could you please share the TC , if possible. 
I am not sure, how the reverted patch causing the crash!!
Project Member

Comment 12 by sheriffbot@chromium.org, Jul 14 2016

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Labels: -ReleaseBlock-Beta -ClusterFuzz -M-53 Clusterfuzz M-54
This regressed in M-54, not M-53.
Cc: -shanmug...@samsung.com e...@chromium.org
Owner: shanmug...@samsung.com
Changing ownership, to access the testcase for a bug
Cc: -e...@chromium.org shanmug...@samsung.com
Owner: e...@chromium.org
Project Member

Comment 16 by sheriffbot@chromium.org, Oct 20 2016

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment