New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 634791 link

Starred by 1 user
Status: Duplicate
Merged: issue 640071
Owner: ----
Closed: Nov 2016
Cc:
█ robho...@gmail.com
█ ranjitkan@chromium.org
e...@chromium.org
dgro...@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug-Regression



Sign in to add a comment

Integer-overflow in blink::LayoutTableCell::computeIntrinsicPadding

Project Member Reported by ClusterFuzz, Aug 5 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4755772829597696

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  blink::LayoutTableCell::computeIntrinsicPadding
  blink::LayoutTableSection::layoutRows
  blink::LayoutTable::layout
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=370022:370027

Minimized Testcase (0.43 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96bADCBT9oOE3wEvpIEDbjXFH8evGBhENVNZlTT1Fe4ppWlzj643EJa9JXbnf2RSPjLAllMtg912zN3m9s2ypRj1g5qfB6L8zLCrIEFNhEQVZ5R3YiamncHG3hx01Mna4gSSlYR2sx9g-e9gFlJQLhxrD3liQ?testcase_id=4755772829597696

Additional requirements: Requires HTTP

Issue manually filed by: ranjitkan

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by ranjitkan@chromium.org, Aug 5 2016

Cc: ranjitkan@chromium.org
Components: Tools>Test>FindIt>CorrectResult
Labels: -Pri-1 -Type-Bug M-54 Findit-for-crash Te-Logged Pri-2 Type-Bug-Regression
Owner: jchaffraix@chromium.org
Status: Assigned (was: Untriaged)
Author: jchaffraix@webkit.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/c9232f6c5d17eb4b380f048e0539ca3714d11077
Time: Fri Oct 05 03:56:17 2012
The CL last changed line 214 of file LayoutTableCell.cpp, which is stack frame 0.

@jchaffraix: Assigning to you, request you to please take a look into it. Please help us to reassign if not with respect to your change.

Thanks.!

Comment 2 by jchaffraix@chromium.org, Aug 15 2016

Cc: robho...@gmail.com jchaffraix@chromium.org
Owner: e...@chromium.org
I have left the Chrome team in January so transfering to Emil for triaging. +Robert in case they are interested too!

Comment 3 by e...@chromium.org, Aug 15 2016

Cc: -jchaffraix@chromium.org dgro...@chromium.org e...@chromium.org
Owner: ----
Status: Available (was: Assigned)

Comment 4 by dtapu...@chromium.org, Nov 9 2016

Components: Blink>Layout
Status: Untriaged (was: Available)

Comment 5 by skobes@chromium.org, Nov 13 2016

Mergedinto: 640071
Status: Duplicate (was: Untriaged)
Project Member

Comment 6 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment