New issue
Advanced search Search tips

Issue 629005 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner: ----
Closed: Jul 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Null crash in blink::SimpleFontData::isTextOrientationFallbackOf

Project Member Reported by ClusterFuzz, Jul 18 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5295890990628864

Fuzzer: attekett_dom_fuzzer
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000494
Crash State:
  blink::SimpleFontData::isTextOrientationFallbackOf
  blink::ShapeResult::fallbackFonts
  blink::CachingWordShaper::width
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=379622:379959

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96DocJWIMd7bxKorQkQsrW3726E6GiN3lNnkVUMQtt6GCcr8oUphswbitOuRQIplt5XtoI5LTmnDVtpS0Yt9la5F7GuXoc-gSETHFUR3M_j60Qs14940H6L99s7ABm5qoAhc-00QXpIWi5bg9DsxmIydtbZCw?testcase_id=5295890990628864


Filer: nyerramilli

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: nyerramilli@chromium.org
Components: Tools>Test>FindIt>CorrectResult
Labels: findit-for-crash Te-Logged M-52
Owner: pdr@chromium.org
Status: Assigned (was: Available)
based on Findit results, assigning to pdr@ - Could you please check the above issue & help us in finding an owner it its not yours.

Suspected CLs	The result is a list of CLs that change the crashed files.

Author: pdr
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/e107996d6e78d90aca060c41d93191eaf1625dc9
Time: Tue Mar 08 21:38:04 2016
Lines 751-752 of file Font.cpp which potentially caused crash are changed in this cl (frame #4, "floatWidthForComplexText").

File CachingWordShaper.cpp is changed in this cl (and is part of stack frame #3, "blink::CachingWordShaper::width")
Minimum distance from crash line to modified line: 0. (file: Font.cpp, crashed on: 751, modified: 751).

Suspected Project: chromium
Suspected Component: Blink>Fonts

Comment 2 by pdr@chromium.org, Jul 22 2016

Cc: pdr@chromium.org
Components: -Tools>Test>FindIt>CorrectResult Blink>Fonts
Labels: -ClusterFuzz -findit-for-crash Clusterfuzz Findit-for-crash
Owner: ----
Status: Untriaged (was: Assigned)
I've re-done the regressed, blame, and fixed tasks for this on clusterfuzz. I don't think my patch is related. It looks like m_fontData is null but it's not clear how. A null deref should probably be P2 instead of P1. Opening this up to Blink>Fonts.

Note: you'll need to run a local server for this to repro: python -m SimpleHTTPServer, then hit localhost:8000/fuzz-104.html

Comment 3 by e...@chromium.org, Jul 25 2016

Labels: -Pri-1 Pri-2
Status: Available (was: Untriaged)
Summary: Null crash in blink::SimpleFontData::isTextOrientationFallbackOf (was: Crash in blink::SimpleFontData::isTextOrientationFallbackOf)

Comment 4 by e...@chromium.org, Jul 25 2016

Status: Fixed (was: Available)
Project Member

Comment 5 by bugdroid1@chromium.org, Jul 25 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/63402c5b51408d48710846f739fe07b2d1b19d1e

commit 63402c5b51408d48710846f739fe07b2d1b19d1e
Author: eae <eae@chromium.org>
Date: Mon Jul 25 23:36:39 2016

Add null-check to ShapeResult::fallbackFonts

Add a null check for m_runs[i]->m_fontData in ShapeResult::fallbackFonts
to ensure that isTextOrientationFallbackOf is only called when it's set.

TBR=pdr@chromium.org
BUG= 629005 

Review-Url: https://codereview.chromium.org/2177163003
Cr-Commit-Position: refs/heads/master@{#407633}

[modify] https://crrev.com/63402c5b51408d48710846f739fe07b2d1b19d1e/third_party/WebKit/Source/platform/fonts/shaping/ShapeResult.cpp

Project Member

Comment 6 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment