Integer-overflow in int WTF::toIntegralType<int, unsigned char> |
||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5596678537347072 Fuzzer: inferno_twister Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: int WTF::toIntegralType<int, unsigned char> blink::HTMLOListElement::parseAttribute blink::Element::attributeChanged Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=370022:370027 Minimized Testcase (0.02 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv96gw3sdGDxVrngG2ag-hBAed1KlP3dwby3P9lBvfWCazmpcGl5pzeP4xTQyZQRt_9MsqH0KEUKf7gA7hEUO6nTWZ-fSgHGaLuDZmg5hcTHUvGMfyuA_yfQBpkP8OLzjbzvLnTINQQzj_jzNbiho0hZquACyOQ?testcase_id=5596678537347072 <ol start=-2147483648> Issue manually filed by: ranjitkan See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Aug 12 2016
We should use parseHTMLInteger() instead of AtomicString::toInt().
,
Oct 11 2016
,
Nov 11 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/d119af9ade51292737ff2c2730f5a14abed0004b commit d119af9ade51292737ff2c2730f5a14abed0004b Author: rob.buis <rob.buis@samsung.com> Date: Fri Nov 11 04:26:01 2016 Fix parsing of 'start' attribute of <ol> element Fix parsing of 'start' attribute of <ol> element by using parseHTMLInteger instead of toInt. This also fixes the last remaining reflection-grouping.html failures. BUG=651762, 634796 Review-Url: https://codereview.chromium.org/2493533002 Cr-Commit-Position: refs/heads/master@{#431495} [delete] https://crrev.com/3baf0674f2018448b9c3232520597f6cf40ec4b9/third_party/WebKit/LayoutTests/imported/wpt/html/dom/reflection-grouping-expected.txt [modify] https://crrev.com/d119af9ade51292737ff2c2730f5a14abed0004b/third_party/WebKit/Source/core/html/HTMLOListElement.cpp
,
Nov 11 2016
Fixed by r431495.
,
Nov 11 2016
,
Nov 14 2016
Issue 634797 has been merged into this issue.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by msrchandra@chromium.org
, Aug 11 2016