New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 634114 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Last visit > 30 days ago
Closed: Aug 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security



Sign in to add a comment

Heap-use-after-free in blink::LayoutFieldset::adjustInnerStyle

Project Member Reported by ClusterFuzz, Aug 3 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6055093080424448

Fuzzer: bj_broddelwerk
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Heap-use-after-free READ 8
Crash Address: 0x61100027ec70
Crash State:
  blink::LayoutFieldset::adjustInnerStyle
  blink::LayoutObject::setStyle
  blink::Element::recalcOwnStyle
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=409223:409458

Minimized Testcase (2.45 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94QrMuDD7Hi4mT49p3-C_LbeppnREJtjPJusCmO4q4pHDRa4Anb5j33PuHlswuYaEz7PCzE7ZWP0-HOSUtjpdGZxvIbw5u8fHR0mUjCSl6Bc5ATSGZgzGn5bUWhRds6cRWbk6vEgOj8EC0Z99ckx5KVZ6ojGg?testcase_id=6055093080424448

Filer: inferno

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Project Member

Comment 1 by ClusterFuzz, Aug 3 2016

Labels: Stability-ThreadSanitizer
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5520419245522944

Fuzzer: attekett_dom_fuzzer
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Heap-use-after-free READ 8
Crash Address: 0x7d3c0000e880
Crash State:
  blink::LayoutBlock::computeChildPreferredLogicalWidths
  blink::LayoutFieldset::computeIntrinsicLogicalWidths
  blink::LayoutBox::computeIntrinsicLogicalWidthUsing
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_tsan_chrome_mp&range=409223:409418

Minimized Testcase (0.67 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96kfZbc_2OvrvqZR7LQPqHIQRmshSgsMRqodNGoWzmbqgQRLpoR1ewpLWe-wP2NWcg841qPL4zXv0DS2RIeFAcLnQ3FZh9A0VxTwQP2_CKsjAvu5HI2-irsrNXuwqbh8jsUU1rFDwNr0K9NjJtRZvqieCt11w?testcase_id=5520419245522944

Filer: inferno

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Project Member

Comment 2 by ClusterFuzz, Aug 3 2016

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5937472917995520

Fuzzer: bj_broddelwerk
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0xf0cf21c6d71a0000
Crash State:
  Bad-cast to blink::LayoutBlock from invalid vptr
  blink::LayoutFieldset::addChild
  blink::LayoutTreeBuilderForText::createLayoutObject
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_chrome&range=409257:409369

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97KUwBUJGsyEBo6njbQCf4CFaWo82husZQJnB4dp929XNMR-dQ9wlzSnoSxBtpYsN6boIIbKLS8RZ0m8jdesenytkbY5IU3fTyezsvm4GdscHNA2xZHZAMf_YtpunbBLt_IllTQEf_e1NONUjQXFfyRUGxOLRH2xq_iex1MbT84wOXosoU?testcase_id=5937472917995520


Additional requirements: Requires Gestures

Filer: inferno

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Owner: glebl@chromium.org
Status: Assigned (was: Untriaged)
Author: glebl
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/c6d69f896f406c9a7801b29cb8c02a88e5b01770
Time: Tue Aug 02 20:22:36 2016
Lines 240 of file LayoutFieldset.cpp which potentially caused crash are changed in this cl (frame #2, "blink::LayoutFieldset::adjustInnerStyle").
Minimum distance from crash line to modified line: 0. (file: LayoutFieldset.cpp, crashed on: 240, modified: 240).

Suspected Project: chromium
Suspected Component: Blink>Layout
Cc: cbiesin...@chromium.org aboxhall@chromium.org
Project Member

Comment 5 by ClusterFuzz, Aug 3 2016

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6453072064937984

Fuzzer: bj_broddelwerk
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0xc0c301d524370000
Crash State:
  Bad-cast to blink::LayoutObject from invalid vptr
  blink::LayoutBlock::computeChildPreferredLogicalWidths
  blink::LayoutFieldset::computeIntrinsicLogicalWidths
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_chrome&range=409257:409369

Minimized Testcase (1.21 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97OdsQNpXAGKP2pqmYD7fmb1NmGl3UWcqmmvWTT3u-89Au2o4vahF5nWg94sme4CXlJbjYuzdWwVFmrQWN0aH_ytXQlSqybI0er4rMpy1_snpoXr8aPPoRI4p4_vhd5UEh6AVliSENEZ9utwAm1YMOIrGzOYA?testcase_id=6453072064937984

Filer: inferno

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Project Member

Comment 6 by ClusterFuzz, Aug 3 2016

Labels: Stability-Memory-MemorySanitizer
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5342320910401536

Fuzzer: bj_broddelwerk
Job Type: linux_msan_chrome
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  blink::LayoutFieldset::addChild
  blink::LayoutTreeBuilderForText::createLayoutObject
  blink::Text::attachLayoutTree
  
Recommended Security Severity: Low

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_chrome&range=409223:409418

Minimized Testcase (8.16 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97lO2hFjlOVdHHZ6SZD7o3HNzUMJfwJO5ekTyjreOSoGem47zAX0ACRoEQvfWYlA71z9Vy2IK_EV7UEZchBXE3BGqiM-Qytz1jg3FPOAtvD8MNY21-ya8a8dDZKeiAIQMzxarkf6RnefGLZAciDUgoerqh2bA?testcase_id=5342320910401536

Additional requirements: Requires Gestures

Filer: inferno

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
glebl@, the revert is failing, can you do it manually / take a look at bug and fix it soon.

Comment 8 by glebl@chromium.org, Aug 3 2016

inferno@, here is the revert that passed tests. https://codereview.chromium.org/2204373002/
thanks.
Components: Blink>Layout
Labels: Pri-1
Project Member

Comment 10 by bugdroid1@chromium.org, Aug 4 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779

commit 7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779
Author: glebl <glebl@chromium.org>
Date: Thu Aug 04 01:42:48 2016

Revert "Auto-rebaseline for r409303"

This reverts commit fbbbbcb99039ef08ae88e51acc0f9e426119ea0b.

Revert "Add grid/flex layout support for <fieldset>"

This reverts commit c6d69f896f406c9a7801b29cb8c02a88e5b01770.

Reason for revert:
Causing use-after-frees on ClusterFuzz.

BUG= 634114 
TBR=dmazzoni@chromium.org

Review-Url: https://codereview.chromium.org/2204373002
Cr-Commit-Position: refs/heads/master@{#409698}

[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/fast/block/basic/fieldset-stretch-to-legend-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/fast/borders/fieldsetBorderRadius-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/fast/css/invalidation/fieldset-disabled-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-display-flex-expected.html
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-display-flex.html
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-display-grid-expected.html
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-display-grid.html
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/fast/forms/fieldset/validation-in-fieldset-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/fast/forms/focus-selection-input-expected.txt
[rename] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/fast/forms/focus-selection-textarea-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/fast/forms/validity-property-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/paint/masks/fieldset-mask-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/block/basic/fieldset-stretch-to-legend-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/borders/fieldsetBorderRadius-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/css/fieldset-display-row-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/css/invalidation/fieldset-disabled-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/forms/006-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/forms/007-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/forms/fieldset/fieldset-align-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/forms/fieldset/fieldset-with-float-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/forms/fieldset/float-before-fieldset-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/forms/fieldset/validation-in-fieldset-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/forms/focus-selection-input-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/forms/validity-property-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/text/whitespace/normal-after-nowrap-breaking-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/writing-mode/fieldsets-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/paint/masks/fieldset-mask-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/svg/custom/inline-svg-in-xhtml-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/linux/fast/block/basic/fieldset-stretch-to-legend-expected.png
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/fast/css/fieldset-display-row-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/fast/forms/006-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/fast/forms/007-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/fieldset-align-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/fieldset-with-float-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/float-before-fieldset-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/fast/forms/focus-selection-textarea-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/fast/text/whitespace/normal-after-nowrap-breaking-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/fast/writing-mode/fieldsets-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/svg/custom/inline-svg-in-xhtml-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/block/basic/fieldset-stretch-to-legend-expected.png
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/fieldset/fieldset-align-expected.png
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/text/whitespace/normal-after-nowrap-breaking-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac-mac10.10/svg/custom/inline-svg-in-xhtml-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/fieldset/fieldset-align-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/text/whitespace/normal-after-nowrap-breaking-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac-mac10.9/svg/custom/inline-svg-in-xhtml-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/mac-retina/fast/forms/fieldset/fieldset-align-expected.png
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/fast/css/fieldset-display-row-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/fast/forms/006-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/fast/forms/007-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/fieldset-align-expected.png
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/fieldset-align-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/fieldset-with-float-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/float-before-fieldset-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/mac/fast/forms/focus-selection-textarea-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/fast/text/whitespace/normal-after-nowrap-breaking-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/fast/writing-mode/fieldsets-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/svg/custom/inline-svg-in-xhtml-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/block/basic/fieldset-stretch-to-legend-expected.png
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/css/fieldset-display-row-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/forms/006-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/forms/007-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/fieldset-align-expected.png
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/fieldset-align-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/fieldset-with-float-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/float-before-fieldset-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/forms/focus-selection-textarea-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/text/whitespace/normal-after-nowrap-breaking-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/writing-mode/fieldsets-expected.txt
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/svg/custom/inline-svg-in-xhtml-expected.txt
[delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/win7/fast/forms/fieldset/fieldset-align-expected.png
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/Source/core/layout/LayoutBlock.cpp
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/Source/core/layout/LayoutFieldset.cpp
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/Source/core/layout/LayoutFieldset.h
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.cpp
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.h
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/Source/core/layout/LayoutGrid.cpp
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/Source/core/layout/LayoutGrid.h
[modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp

Project Member

Comment 11 by ClusterFuzz, Aug 4 2016

ClusterFuzz has detected this issue as fixed in range 409660:409712.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5937472917995520

Fuzzer: bj_broddelwerk
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0xf0cf21c6d71a0000
Crash State:
  Bad-cast to blink::LayoutBlock from invalid vptr
  blink::LayoutFieldset::addChild
  blink::LayoutTreeBuilderForText::createLayoutObject
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_chrome&range=409257:409369
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_chrome&range=409660:409712

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97KUwBUJGsyEBo6njbQCf4CFaWo82husZQJnB4dp929XNMR-dQ9wlzSnoSxBtpYsN6boIIbKLS8RZ0m8jdesenytkbY5IU3fTyezsvm4GdscHNA2xZHZAMf_YtpunbBLt_IllTQEf_e1NONUjQXFfyRUGxOLRH2xq_iex1MbT84wOXosoU?testcase_id=5937472917995520


Additional requirements: Requires Gestures

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 12 by ClusterFuzz, Aug 4 2016

ClusterFuzz has detected this issue as fixed in range 409491:409517.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6453072064937984

Fuzzer: bj_broddelwerk
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0xc0c301d524370000
Crash State:
  Bad-cast to blink::LayoutObject from invalid vptr
  blink::LayoutBlock::computeChildPreferredLogicalWidths
  blink::LayoutFieldset::computeIntrinsicLogicalWidths
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_chrome&range=409257:409369
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_chrome&range=409491:409517

Minimized Testcase (1.21 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97OdsQNpXAGKP2pqmYD7fmb1NmGl3UWcqmmvWTT3u-89Au2o4vahF5nWg94sme4CXlJbjYuzdWwVFmrQWN0aH_ytXQlSqybI0er4rMpy1_snpoXr8aPPoRI4p4_vhd5UEh6AVliSENEZ9utwAm1YMOIrGzOYA?testcase_id=6453072064937984

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 13 by sheriffbot@chromium.org, Aug 4 2016

Labels: M-54
Project Member

Comment 14 by sheriffbot@chromium.org, Aug 4 2016

Labels: ReleaseBlock-Beta
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Mergedinto: 633958
Status: Duplicate (was: Assigned)
Status: Assigned (was: Duplicate)
closing per comment #12
Status: Fixed (was: Assigned)
Project Member

Comment 19 by ClusterFuzz, Aug 5 2016

ClusterFuzz has detected this issue as fixed in range 409589:409863.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5342320910401536

Fuzzer: bj_broddelwerk
Job Type: linux_msan_chrome
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  blink::LayoutFieldset::addChild
  blink::LayoutTreeBuilderForText::createLayoutObject
  blink::Text::attachLayoutTree
  
Recommended Security Severity: Low

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_chrome&range=409223:409418
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_chrome&range=409589:409863

Minimized Testcase (8.16 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97lO2hFjlOVdHHZ6SZD7o3HNzUMJfwJO5ekTyjreOSoGem47zAX0ACRoEQvfWYlA71z9Vy2IK_EV7UEZchBXE3BGqiM-Qytz1jg3FPOAtvD8MNY21-ya8a8dDZKeiAIQMzxarkf6RnefGLZAciDUgoerqh2bA?testcase_id=5342320910401536

Additional requirements: Requires Gestures

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 20 by sheriffbot@chromium.org, Aug 5 2016

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 21 by sheriffbot@chromium.org, Nov 11 2016

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment