New issue
Advanced search Search tips

Issue 637187 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Aug 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Integer-overflow in GrSurface::WorseCaseSize

Project Member Reported by ClusterFuzz, Aug 12 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6189197880983552

Fuzzer: miaubiz_svg_fuzzer
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  GrSurface::WorseCaseSize
  GrTextureProvider::refScratchTexture
  GrContext::makeDrawContext
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=398502:398570

Minimized Testcase (2.42 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96kDAZE4vDfEocI0uLyG6zU7kCBONB5MZDnRbo0ZypnB5WdUQ9FzmWh-nulXs67CkWlHzj4TAp_HsUBlm_gC8pFBhXqn7dJTJymbngxru4V-MspWMmYKaeOSeT3lElzPkYSPtirqCujSDXXL0FAm9U8VccXDA?testcase_id=6189197880983552

Issue manually filed by: ajha

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 

Comment 1 by ajha@chromium.org, Aug 12 2016

Cc: ajha@chromium.org
Components: Internals>GPU>Rasterization
Labels: Findit-for-crash Te-Logged M-53
Owner: robertphillips@chromium.org
Status: Assigned (was: Untriaged)
Findit result:
==============
Suspected CLs	No CL in the regression range changes the crashed files. The result is the blame information.

Author: robertphillips
Project: chromium-skia
Changelist: https://chromium.googlesource.com/skia.git/+/6e83ac778f8f90939abe3aee3ea865428dff592f
Time: Thu Aug 13 12:19:14 2015
The CL last changed line 32 of file GrSurface.cpp, which is stack frame 0.

Author: robertphillips
Project: chromium-skia
Changelist: https://chromium.googlesource.com/skia.git/+/6e83ac778f8f90939abe3aee3ea865428dff592f
Time: Thu Aug 13 12:19:14 2015
The CL last changed line 142 of file GrTextureProvider.cpp, which is stack frame 1.

Author: robertphillips
Project: chromium-skia
Changelist: https://chromium.googlesource.com/skia.git/+/d4c741e3d0e0fa633399691c47f76b6c7841ee83
Time: Thu Apr 28 16:55:15 2016
The CL last changed line 694 of file GrContext.cpp, which is stack frame 2.

Author: robertphillips
Project: chromium-skia
Changelist: https://chromium.googlesource.com/skia.git/+/6738c702423226619ee0172c12a3a007c5f68e57
Time: Wed Jul 27 19:13:51 2016
The CL last changed line 244 of file SkXfermodeImageFilter.cpp, which is stack frame 3.

Author: robertphillips
Project: chromium-skia
Changelist: https://chromium.googlesource.com/skia.git/+/f230c6d979d7035cbf6995da8a0161e7802b92b7
Time: Fri Apr 15 19:47:42 2016
The CL last changed line 90 of file SkXfermodeImageFilter.cpp, which is stack frame 4.

Author: robertphillips
Project: chromium-skia
Changelist: https://chromium.googlesource.com/skia.git/+/2302de920e5434809bd0e85b871a6e002856dfdb
Time: Thu Mar 24 14:26:32 2016
The CL last changed line 212 of file SkImageFilter.cpp, which is stack frame 5.

Author: robertphillips
Project: chromium-skia
Changelist: https://chromium.googlesource.com/skia.git/+/2302de920e5434809bd0e85b871a6e002856dfdb
Time: Thu Mar 24 14:26:32 2016
The CL last changed line 442 of file SkImageFilter.cpp, which is stack frame 6.

Suspected Project: chromium-skia
Suspected Component: Internals>GPU>Rasterization
==========================================================================
 
Based on the above Findit result assigning to robertphillips@ for further investigation.
Cc: robertph...@google.com
Project Member

Comment 3 by bugdroid1@chromium.org, Aug 17 2016

The following revision refers to this bug:
  https://skia.googlesource.com/skia.git/+/4c56b9fa714d1bee54666adf7e5e1db5fb398dc7

commit 4c56b9fa714d1bee54666adf7e5e1db5fb398dc7
Author: robertphillips <robertphillips@google.com>
Date: Wed Aug 17 15:02:51 2016

Cast for fuzzer complaint

Given the cast in the following else block, this isn't the first time we've encountered this.

BUG= 637187 
GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2258463002

Review-Url: https://codereview.chromium.org/2258463002

[modify] https://crrev.com/4c56b9fa714d1bee54666adf7e5e1db5fb398dc7/src/gpu/GrSurface.cpp

Project Member

Comment 4 by bugdroid1@chromium.org, Aug 17 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/97557689e0afded20df656c083eb2cb6f5ce6e5c

commit 97557689e0afded20df656c083eb2cb6f5ce6e5c
Author: skia-deps-roller <skia-deps-roller@chromium.org>
Date: Wed Aug 17 16:40:36 2016

Roll src/third_party/skia/ ff863bc55..d24ee1419 (5 commits).

https://chromium.googlesource.com/skia.git/+log/ff863bc550a8..d24ee1419f17

$ git log ff863bc55..d24ee1419 --date=short --no-merges --format='%ad %ae %s'
2016-08-17 fmalita [SVGDom] Add <line> support
2016-08-17 robertphillips Cast for fuzzer complaint
2016-08-17 jvanverth Add alternative ambient shadow method to Android shadow sample
2016-08-17 halcanary SkPDF: pull out SkPDFMakeCIDGlyphWidthsArray.cpp
2016-08-17 rmistry Add gerrit config lines to cq.cfg

BUG= 637187 

CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_precise_blink_rel
TBR=robertphillips@google.com

Review-Url: https://codereview.chromium.org/2253933002
Cr-Commit-Position: refs/heads/master@{#412558}

[modify] https://crrev.com/97557689e0afded20df656c083eb2cb6f5ce6e5c/DEPS

Project Member

Comment 5 by ClusterFuzz, Aug 18 2016

ClusterFuzz has detected this issue as fixed in range 412507:412570.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6189197880983552

Fuzzer: miaubiz_svg_fuzzer
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  GrSurface::WorseCaseSize
  GrTextureProvider::refScratchTexture
  GrContext::makeDrawContext
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=398502:398570
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=412507:412570

Minimized Testcase (2.42 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96kDAZE4vDfEocI0uLyG6zU7kCBONB5MZDnRbo0ZypnB5WdUQ9FzmWh-nulXs67CkWlHzj4TAp_HsUBlm_gC8pFBhXqn7dJTJymbngxru4V-MspWMmYKaeOSeT3lElzPkYSPtirqCujSDXXL0FAm9U8VccXDA?testcase_id=6189197880983552

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Aug 18 2016

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 7 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment