Author: danakj
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/76b13bfe17a7bf70ea6a2763e1f8c68aca794f66
Time: Mon Oct 20 17:08:01 2014
The CL last changed line 58 of file point.h, which is stack frame 0.

@danakj: Assigning to you, request you to please take a look into it. Please help us to reassign if not with respect to your change.

Thanks.!

RenderWidgetHostViewAura::ConvertRectToScreen is moving a Point so far that it can't fit into an int anymore.

Looks like we are getting the selection bounds from the renderer. Do we need to sanitize them before we use them? (https://cs.chromium.org/chromium/src/content/browser/renderer_host/render_widget_host_impl.cc?sq=package:chromium&type=cs&rcl=1470396217&l=1289)

--> shuchen@ as the IME owner for triage. cc+ ekaramad@

On the browser side, we do transform the points from widget coordinates to root coordinates along the way:
https://cs.chromium.org/chromium/src/content/browser/renderer_host/text_input_manager.cc?rcl=0&l=156
cc-ing kenrb@.

kenrb: Could it be related to coordinate transformation errors.

ClusterFuzz has detected this issue as fixed in range 422899:423265.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5878269444620288

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  gfx::Point::Offset
  content::RenderWidgetHostViewAura::ConvertRectToScreen
  content::RenderWidgetHostViewAura::GetCaretBounds
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=370022:370027
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=422899:423265

Minimized Testcase (8.36 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96-8csDDj-Cx0jeiouYprkveCu0dSs9ouRc-3qOvbqwIs1zPfYrzOMFMnJUzyFjm6G3EpdyVedgC3BLbc8lmU8IzGe1Osfg6bwMbrsdu9qPJlvX67lxZPN0DylUZH-_N2TrcNKn4Kdo8FM0SSKMKctOEs_HLQ?testcase_id=5878269444620288

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot