Issue metadata
Sign in to add a comment
|
Integer-overflow in gfx::Rect::bottom |
||||||||||||||||||||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5522560597098496 Fuzzer: inferno_twister Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: gfx::Rect::bottom cc::Occlusion::GetUnoccludedContentRect cc::RenderSurfaceImpl::AppendQuads Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=407167:409418 Minimized Testcase (14.35 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95gW-oQSPRKQQ0dHukpwrz2_Dgx_GjDIG9ygXNEDJfgRsXP2ASF4cKoVmqqepBPcxrK7W6cxmD5CD7nH2O-cQX8Tgg5m9fpLD2337r_ajctDoONMpjZHlvIakuyWsXBGUOtfj3YndEtIrxSHrI7ZK6aax0l_A?testcase_id=5522560597098496 Issue manually filed by: durga.behera See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Aug 25 2016
Reassigning to sunxd@ who has a CL in progress (https://codereview.chromium.org/2268423003/) to prevent overflow in gfx::Rect::bottom.
,
Sep 2 2016
,
Sep 3 2016
ClusterFuzz has detected this issue as fixed in range 415934:416233. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5522560597098496 Fuzzer: inferno_twister Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: gfx::Rect::bottom cc::Occlusion::GetUnoccludedContentRect cc::RenderSurfaceImpl::AppendQuads Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=407167:409418 Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=415934:416233 Minimized Testcase (14.35 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95gW-oQSPRKQQ0dHukpwrz2_Dgx_GjDIG9ygXNEDJfgRsXP2ASF4cKoVmqqepBPcxrK7W6cxmD5CD7nH2O-cQX8Tgg5m9fpLD2337r_ajctDoONMpjZHlvIakuyWsXBGUOtfj3YndEtIrxSHrI7ZK6aax0l_A?testcase_id=5522560597098496 See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by durga.behera@chromium.org
, Aug 25 2016Labels: M-54 Te-Logged
Owner: ajuma@chromium.org
Status: Assigned (was: Untriaged)