Issue metadata
Sign in to add a comment
|
Use-of-uninitialized-value in gpu::gles2::GLES2DecoderImpl::HandleGetBufferParameteriv |
||||||||||||||||||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5745610296918016 Fuzzer: libfuzzer_gpu_fuzzer Job Type: libfuzzer_chrome_msan Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: gpu::gles2::GLES2DecoderImpl::HandleGetBufferParameteriv gpu::error::Error gpu::gles2::GLES2DecoderImpl::DoCommandsImpl<false> gpu::CommandParser::ProcessCommands Recommended Security Severity: Low Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=405554:405701 Minimized Testcase (0.02 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97E-tiF_-Q7Pj2fuYJiw7EeU2T9flLOK_cKBz_fgPFuIuZmPLvV0CK4l4wMUvTrB01oxf0foefXchVfltxTt2qQ1UXiRmnUlUcGuzgBWmHXN3BBpKEHrzRdtLsYzmkqRbuKzXIwgmYsf0-MXEz8mPN8JGCBAw?testcase_id=5745610296918016 Additional requirements: Requires Gestures Filer: mmoroz See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Jul 20 2016
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jul 20 2016
,
Jul 20 2016
,
Jul 20 2016
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6440318639800320 Fuzzer: libfuzzer_gpu_fuzzer Job Type: libfuzzer_chrome_msan Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: gpu::gles2::GLES2DecoderImpl::HandleGetProgramiv gpu::error::Error gpu::gles2::GLES2DecoderImpl::DoCommandsImpl<false> gpu::CommandParser::ProcessCommands Recommended Security Severity: Medium Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=405554:405701 Minimized Testcase (0.02 Kb): https://cluster-fuzz.appspot.com/download/AMIfv960v0nVDvUk66AYJKJmEfhin1QbIkwEeYoREMV_k2zqquB-mDOwT4U10Wg4cUH6cwE-Pn24v6n67fJ3p_IWhkV3rH_ipvTCOfCULNkuHcpL-ijKlTHCYp3Ar0vqAFIn-lZ2tHS916h_MbF_7zWrkfLhuWwXTA?testcase_id=6440318639800320 Filer: inferno See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Jul 20 2016
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6315402468786176 Fuzzer: libfuzzer_gpu_fuzzer Job Type: libfuzzer_chrome_msan Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: gpu::gles2::GLES2DecoderImpl::HandleGetShaderiv gpu::error::Error gpu::gles2::GLES2DecoderImpl::DoCommandsImpl<false> gpu::CommandParser::ProcessCommands Recommended Security Severity: Medium Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=405554:405701 Minimized Testcase (0.02 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96-CVaupgSqcL31fRsws3Kx1Pc2DjY77H_ELYFAW6rzOjAkyXlW0-3b6Rc_EZKjQdvuUpydpRikNFvfVsP3yEpXaZtzWFwdWJiDmB0DlP8YqO-78WRB77N2ZQineRw3RsTFKRD5JSK6oZlJesHndgcW4dq4MA?testcase_id=6315402468786176 Filer: inferno See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Jul 20 2016
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6163640915066880 Fuzzer: libfuzzer_gpu_fuzzer Job Type: libfuzzer_chrome_msan Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: gpu::gles2::GLES2DecoderImpl::HandleGetVertexAttribPointerv gpu::error::Error gpu::gles2::GLES2DecoderImpl::DoCommandsImpl<false> gpu::CommandParser::ProcessCommands Recommended Security Severity: Medium Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=405554:405701 Minimized Testcase (0.02 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94DRr52sNMs_N1K1rVHivRwG_8sYHsmH8uHL6Nj7UJikgmmsNwHoejWzw_y_-E4qbif4IbDI09I388jCdWErr-GSRCDzWD4SUNNJ7DrYk8TIJ5gju4EwnS5sLHO26krfnRgqtEeqvbJgbed1DVR43talvwZ8g?testcase_id=6163640915066880 Filer: inferno See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Jul 20 2016
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6103714805055488 Fuzzer: libfuzzer_gpu_fuzzer Job Type: libfuzzer_chrome_msan Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: gpu::gles2::GLES2DecoderImpl::HandleGetTexParameterfv gpu::error::Error gpu::gles2::GLES2DecoderImpl::DoCommandsImpl<false> gpu::CommandParser::ProcessCommands Recommended Security Severity: Low Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=405554:405701 Minimized Testcase (0.02 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94TvOXZqA-57tVMZ3JmxKyjKH8BD-7saTomeRv3VddhSMIdPE46DD3XuG8GgrFsjPhR_-p8A7L_g4slua7wnTE0_mf-vNHGfubsSzl5RQYsMm6EzVkgrkBMENEj3KdW083hN3LZ4Ae_iijleVnC1WbcnD2SyQ?testcase_id=6103714805055488 Additional requirements: Requires Gestures Filer: inferno See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Jul 20 2016
There are several variants of this, unclear if these are same or different bugs. For now tracking as same bug.
,
Jul 20 2016
This is an issue in the harness - all of these are related. The transfer buffer referenced by the command buffer is uninitialized, and that's what the decoder reads. There is a trivial fix, but it also tells me that this area will be a bit difficult to get coverage on, unless I make up a way to extract bits out of the test string to fill that transfer buffer. Will think of ways.
,
Jul 20 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/e7c83bff969b4114b280a0bfb146f7618a76ede1 commit e7c83bff969b4114b280a0bfb146f7618a76ede1 Author: piman <piman@chromium.org> Date: Wed Jul 20 23:39:09 2016 fuzzer: initialize transfer buffer memory BUG= 629795 CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel Review-Url: https://codereview.chromium.org/2170653002 Cr-Commit-Position: refs/heads/master@{#406713} [modify] https://crrev.com/e7c83bff969b4114b280a0bfb146f7618a76ede1/gpu/command_buffer/tests/fuzzer_main.cc
,
Jul 20 2016
,
Jul 21 2016
ClusterFuzz has detected this issue as fixed in range 406546:406721. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6163640915066880 Fuzzer: libfuzzer_gpu_fuzzer Job Type: libfuzzer_chrome_msan Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: gpu::gles2::GLES2DecoderImpl::HandleGetVertexAttribPointerv gpu::error::Error gpu::gles2::GLES2DecoderImpl::DoCommandsImpl<false> gpu::CommandParser::ProcessCommands Recommended Security Severity: Medium Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=405554:405701 Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=406546:406721 Minimized Testcase (0.02 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94DRr52sNMs_N1K1rVHivRwG_8sYHsmH8uHL6Nj7UJikgmmsNwHoejWzw_y_-E4qbif4IbDI09I388jCdWErr-GSRCDzWD4SUNNJ7DrYk8TIJ5gju4EwnS5sLHO26krfnRgqtEeqvbJgbed1DVR43talvwZ8g?testcase_id=6163640915066880 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jul 21 2016
ClusterFuzz has detected this issue as fixed in range 406546:406721. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6440318639800320 Fuzzer: libfuzzer_gpu_fuzzer Job Type: libfuzzer_chrome_msan Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: gpu::gles2::GLES2DecoderImpl::HandleGetProgramiv gpu::error::Error gpu::gles2::GLES2DecoderImpl::DoCommandsImpl<false> gpu::CommandParser::ProcessCommands Recommended Security Severity: Medium Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=405554:405701 Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=406546:406721 Minimized Testcase (0.02 Kb): https://cluster-fuzz.appspot.com/download/AMIfv960v0nVDvUk66AYJKJmEfhin1QbIkwEeYoREMV_k2zqquB-mDOwT4U10Wg4cUH6cwE-Pn24v6n67fJ3p_IWhkV3rH_ipvTCOfCULNkuHcpL-ijKlTHCYp3Ar0vqAFIn-lZ2tHS916h_MbF_7zWrkfLhuWwXTA?testcase_id=6440318639800320 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jul 21 2016
ClusterFuzz has detected this issue as fixed in range 406546:406721. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6315402468786176 Fuzzer: libfuzzer_gpu_fuzzer Job Type: libfuzzer_chrome_msan Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: gpu::gles2::GLES2DecoderImpl::HandleGetShaderiv gpu::error::Error gpu::gles2::GLES2DecoderImpl::DoCommandsImpl<false> gpu::CommandParser::ProcessCommands Recommended Security Severity: Medium Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=405554:405701 Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=406546:406721 Minimized Testcase (0.02 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96-CVaupgSqcL31fRsws3Kx1Pc2DjY77H_ELYFAW6rzOjAkyXlW0-3b6Rc_EZKjQdvuUpydpRikNFvfVsP3yEpXaZtzWFwdWJiDmB0DlP8YqO-78WRB77N2ZQineRw3RsTFKRD5JSK6oZlJesHndgcW4dq4MA?testcase_id=6315402468786176 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jul 21 2016
ClusterFuzz has detected this issue as fixed in range 406546:406721. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5745610296918016 Fuzzer: libfuzzer_gpu_fuzzer Job Type: libfuzzer_chrome_msan Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: gpu::gles2::GLES2DecoderImpl::HandleGetBufferParameteriv gpu::error::Error gpu::gles2::GLES2DecoderImpl::DoCommandsImpl<false> gpu::CommandParser::ProcessCommands Recommended Security Severity: Low Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=405554:405701 Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=406546:406721 Minimized Testcase (0.02 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97E-tiF_-Q7Pj2fuYJiw7EeU2T9flLOK_cKBz_fgPFuIuZmPLvV0CK4l4wMUvTrB01oxf0foefXchVfltxTt2qQ1UXiRmnUlUcGuzgBWmHXN3BBpKEHrzRdtLsYzmkqRbuKzXIwgmYsf0-MXEz8mPN8JGCBAw?testcase_id=5745610296918016 Additional requirements: Requires Gestures See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jul 21 2016
ClusterFuzz has detected this issue as fixed in range 406546:406721. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6103714805055488 Fuzzer: libfuzzer_gpu_fuzzer Job Type: libfuzzer_chrome_msan Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: gpu::gles2::GLES2DecoderImpl::HandleGetTexParameterfv gpu::error::Error gpu::gles2::GLES2DecoderImpl::DoCommandsImpl<false> gpu::CommandParser::ProcessCommands Recommended Security Severity: Low Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=405554:405701 Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=406546:406721 Minimized Testcase (0.02 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94TvOXZqA-57tVMZ3JmxKyjKH8BD-7saTomeRv3VddhSMIdPE46DD3XuG8GgrFsjPhR_-p8A7L_g4slua7wnTE0_mf-vNHGfubsSzl5RQYsMm6EzVkgrkBMENEj3KdW083hN3LZ4Ae_iijleVnC1WbcnD2SyQ?testcase_id=6103714805055488 Additional requirements: Requires Gestures See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jul 21 2016
,
Jul 26 2016
,
Oct 27 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by mmoroz@chromium.org
, Jul 20 2016Components: Internals>GPU
Labels: M-53 Pri-2
Owner: piman@chromium.org