New issue
Advanced search Search tips

Issue 638504 link

Starred by 1 user
Status: Verified
Owner:
drott@chromium.org
Closed: Apr 2018
Cc:
ajha@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Integer-overflow in OT::propagate_attachment_offsets

Project Member Reported by ClusterFuzz, Aug 17 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5576311609491456

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  OT::propagate_attachment_offsets
  OT::GPOS::position_finish_offsets
  hb_ot_shape_internal
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=377242:377255

Minimized Testcase (22.42 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96qiaAdY5SxttYkhlmrkvvEMJyp8huGwM4K-RUFCqU1UScVl2zWzC24PzRdYPE8FJ2i0UBljbcO-ei7TDeaOXoN2qcaDw3NyijSDtW0_vgqlf4f4CmFuHRLrBMfchtTs0U6luVLz9tea6PKxfLVDmhIf23Ptxxhx0kUNQdDLPHZl21oMFk?testcase_id=5576311609491456

Issue manually filed by: ajha

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by ajha@chromium.org, Aug 17 2016

Cc: ajha@chromium.org
Components: Blink>Fonts
Labels: Findit-for-crash Te-Logged M-53
Owner: drott@chromium.org
Status: Assigned (was: Untriaged)
FindIt result:
==============
Suspected CLs	The result is a list of CLs that change the crashed files.

Author: drott
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/aa0c4d1c5fa80154d0e9cab3df4c6aad4acb79d6
Time: Wed Feb 24 09:10:04 2016
Lines 768 of file hb-ot-shape.cc which potentially caused crash are changed in this cl (frame #4, "hb_ot_shape_internal").

Lines 1576-1592, 1600, 1621 of file hb-ot-layout-gpos-table.hh which potentially caused crash are changed in this cl (frame #0, "OT::propagate_attachment_offsets"; frame #1, "OT::GPOS::position_finish_offsets").
Minimum distance from crash line to modified line: 0. (file: hb-ot-shape.cc, crashed on: 768, modified: 768).

Suspected Project: chromium
Suspected Component: Blink>Fonts

Assigning to drott@ for further investigation.

Thank you!

Comment 2 by infe...@chromium.org, Oct 11 2016

Labels: Pri-2
Project Member

Comment 3 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 4 by ClusterFuzz, Oct 1 2017

Labels: Test-Predator-AutoComponents
Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.

Comment 5 by mbarbe...@chromium.org, Nov 7 2017

Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components
Project Member

Comment 6 by ClusterFuzz, Apr 18 2018 

ClusterFuzz has detected this issue as fixed in range 551565:551568.

Detailed report: https://clusterfuzz.com/testcase?key=5576311609491456

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  OT::propagate_attachment_offsets
  OT::GPOS::position_finish_offsets
  hb_ot_position_complex
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=377242:377255
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=551565:551568

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5576311609491456

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Apr 18 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5576311609491456 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
►

Sign in to add a comment