Suspected CLs	No CL in the regression range changes the crashed files. The result is the blame information.

Author: bungeman@google.com
Project: chromium-skia
Changelist: https://chromium.googlesource.com/skia.git/+/10ba006631a0c350aa2bcba188a60404869607c8
Time: Fri Oct 25 18:40:24 2013
The CL last changed line 35 of file SkRefCnt.h, which is stack frame 3.

Author: bungeman@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/daa831939e0b34653cce03daaa1aca46d5c448cb
Time: Thu Oct 24 21:58:01 2013
The CL last changed line 13 of file sk_ref_cnt_ext_release.h, which is stack frame 4.

Author: robertphillips
Project: chromium-skia
Changelist: https://chromium.googlesource.com/skia.git/+/3e302275b324172c845627cbd00cee8a06571baf
Time: Wed Apr 20 18:48:36 2016
The CL last changed line 59 of file SkSpecialImage.cpp, which is stack frame 5.

Author: robertphillips
Project: chromium-skia
Changelist: https://chromium.googlesource.com/skia.git/+/3e302275b324172c845627cbd00cee8a06571baf
Time: Wed Apr 20 18:48:36 2016
The CL last changed line 25 of file SkSpecialImage.cpp, which is stack frame 6.

Suspected Project: chromium-buildtools

robertphillips@: Could you please take a look at this.

IIUC, what appears to be going on is that we are exceeding the the soft rss limit and allocator_may_return_null is set to 1. So, the allocator is returning null but the initialization of the C++ class that was being newed continues on - leading to the writes to 0x08 (to initialize the ref count). 

It seems that we either want allocator_may_return_null to be set to false (which, I believe, mirrors Chromium's use case) or make sure asan doesn't allow the constructor to be called if memory allocation fails.

 Issue 627047  has been merged into this issue.

 Issue 626476  has been merged into this issue.

 Issue 627342  has been merged into this issue.

 Issue 623669  has been merged into this issue.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4620812862881792

Fuzzer: sugoi_filter_fuzzer
Job Type: linux_asan_filter_fuzz_stub_32bit
Platform Id: linux

Crash Type: UNKNOWN WRITE
Crash Address: 0x00000004
Crash State:
  SkPixelRef::SkPixelRef
  SkMallocPixelRef::NewZeroed
  SkMallocPixelRef::ZeroedPRFactory::create
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_filter_fuzz_stub_32bit&range=357565:358520

Minimized Testcase (0.74 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97usyx3lPAMepeP-Fr839CzatXzKcarLHqN3wYxdtJQI8KkyJi1pq89UHyV29E8FXqdiTk_a73BYcK8UKEqumC4uTy6zSUgt-gf80yshCLPGy0TyI8lysi0bzPdyUErxR4gnKn7D8YItzjOt7nMzgQJv2krZQ?testcase_id=4620812862881792

Filer: rnimmagadda

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

reed/bsalomon@, could you please help us to find a right owner if possible?

Thank you!

It looks like "new" has returned NULL, which it is never supposed to! Is the fuzzer building/running in a different mode than chrome, and allowing new to return null?

 Issue 628326  has been merged into this issue.

ClusterFuzz has detected this issue as fixed in range 413737:413791.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4620812862881792

Fuzzer: sugoi_filter_fuzzer
Job Type: linux_asan_filter_fuzz_stub_32bit
Platform Id: linux

Crash Type: UNKNOWN WRITE
Crash Address: 0x00000004
Crash State:
  SkPixelRef::SkPixelRef
  SkMallocPixelRef::NewZeroed
  SkMallocPixelRef::ZeroedPRFactory::create
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_filter_fuzz_stub_32bit&range=357565:358520
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_filter_fuzz_stub_32bit&range=413737:413791

Minimized Testcase (0.74 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97usyx3lPAMepeP-Fr839CzatXzKcarLHqN3wYxdtJQI8KkyJi1pq89UHyV29E8FXqdiTk_a73BYcK8UKEqumC4uTy6zSUgt-gf80yshCLPGy0TyI8lysi0bzPdyUErxR4gnKn7D8YItzjOt7nMzgQJv2krZQ?testcase_id=4620812862881792

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot