New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 641478 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Aug 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Integer-overflow in SkTAbs<int>

Project Member Reported by ClusterFuzz, Aug 26 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4748314107183104

Fuzzer: libfuzzer_skia_pathop_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  SkTAbs<int>
  UseInnerWinding
  SkOpSegment::markAngle
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=414663:414681

Minimized Testcase (0.31 Kb): https://cluster-fuzz.appspot.com/download/AMIfv968k_0jTqYYpTExTJxwWtxIUbgcuWZKZkL5YgwJs_n2xc_KBgdEjadEGiTtSaNteLZojVzlMq7fSuRnnxS83z-S0E__BqtDePOILRJfsWjNqr3JzFj3YDQY4GEg0HRjJKkW74MBygIl2wB6KdtbQKUG1lF8HA?testcase_id=4748314107183104

Issue manually filed by: mmoroz

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 

Comment 1 by mmoroz@chromium.org, Aug 26 2016

Cc: mmoroz@chromium.org kcc@chromium.org aizatsky@chromium.org
Components: Internals>Skia
Owner: caryclark@chromium.org
Project Member

Comment 3 by ClusterFuzz, Aug 27 2016

ClusterFuzz has detected this issue as fixed in range 414779:414830.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4748314107183104

Fuzzer: libfuzzer_skia_pathop_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  SkTAbs<int>
  UseInnerWinding
  SkOpSegment::markAngle
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=414663:414681
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=414779:414830

Minimized Testcase (0.31 Kb): https://cluster-fuzz.appspot.com/download/AMIfv968k_0jTqYYpTExTJxwWtxIUbgcuWZKZkL5YgwJs_n2xc_KBgdEjadEGiTtSaNteLZojVzlMq7fSuRnnxS83z-S0E__BqtDePOILRJfsWjNqr3JzFj3YDQY4GEg0HRjJKkW74MBygIl2wB6KdtbQKUG1lF8HA?testcase_id=4748314107183104

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 4 by ClusterFuzz, Aug 27 2016

Labels: ClusterFuzz-Verified
Status: Verified (was: Untriaged)
ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 5 by bugdroid1@chromium.org, Aug 27 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/6a205ea39d9075faa18bbc13c9d52bd8b1ce938a

commit 6a205ea39d9075faa18bbc13c9d52bd8b1ce938a
Author: skia-deps-roller <skia-deps-roller@chromium.org>
Date: Sat Aug 27 10:39:55 2016

Roll src/third_party/skia/ 9d08cbc8c..79418093c (46 commits).

https://chromium.googlesource.com/skia.git/+log/9d08cbc8c613..79418093c1bb

$ git log 9d08cbc8c..79418093c --date=short --no-merges --format='%ad %ae %s'
2016-08-26 caryclark if the winding of the top can't be computed, give up
2016-08-26 mtklein GN: support compiler_prefix, use it for ccache on bots.
2016-08-26 halcanary SkPDF: Glyph validation change
2016-08-26 fmalita drawBitmapRect() should not touch the CTM when mask filters are present
2016-08-26 msarett Reduce CPU overhead on drawRegion()
2016-08-26 brianosman Fix angle build on Ubuntu
2016-08-26 bungeman Expat target exports includes instead of FreeType.
2016-08-26 mtklein Add Mac NDK asset, and fetch NDK on Android compile bots.
2016-08-26 egdaniel Don't add the resolve attachment to vulkan render passes.
2016-08-26 ethannicholas fixed 'corners' of paths in GrAAConvexTessellator
2016-08-26 mtklein add an asset for the Linux Android NDK.
2016-08-26 bsalomon Converts a drawPaint through a rrect clip to a drawRRect in GrDrawContext.
2016-08-26 brianosman Update ANGLE to latest as of August 25, 2016
2016-08-26 fmalita Remove SVG serialization suppressions
2016-08-26 fmalita Add imagemasksubset GM
2016-08-26 drott Restrict supported font formats in Chrome context
2016-08-26 robertphillips Move work from ctor to onOnceBeforeDraw in ShowMipLevel GMs
2016-08-26 caryclark avoid generating degenerate conic from arc
2016-08-26 vjiaoblack Added distance attenuation and diffuse shading to PointLights
2016-08-26 jvanverth Fix for fat stroked roundrects.
2016-08-26 mtklein GN: mac host and armv7 target
2016-08-26 bungeman SkOSFile instead of dirent in android font parser.
2016-08-26 bsalomon Fix bounds check in grshape test GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2274113004
2016-08-26 msarett drawRegion() cleanups
2016-08-26 robertphillips Ignore fill when stroke & filling convex line-only paths
2016-08-25 msarett GPU implementation of drawRegion()
2016-08-25 mtklein GN: Android
2016-08-25 msarett Add drawRegion() API to SkCanvas
2016-08-25 egdaniel Add support for getting vulkan descriptor sets without a GrVkUniformHandler.
2016-08-25 liyuqian Do not spam the debugging information
2016-08-25 bsalomon Respecify SkCanvas::drawArc, consolidate conversion to SkPath, add GM for oddball drawArcs
2016-08-25 caryclark path ops stream-lining
2016-08-25 halcanary SkDrawCommand: hinting
2016-08-25 jcgregorio BUILD.gn: Fix fiddle raster.
2016-08-25 halcanary SkPDF: Stop `#include PREPROCESSOR_DEFINE` pattern
2016-08-25 brianosman Remove pixel config fallback - failing is a better option.
2016-08-25 mtklein update Android auto-detection.
2016-08-25 fmalita Reland: Experimental parsing expression grammar (PEG) template library
2016-08-25 jvanverth Add Ganesh support for circular roundrects with strokes > 2*radii.
2016-08-25 bsalomon Make bleed GM produce consistent bitmaps on all platforms GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2264133003
2016-08-25 vjiaoblack Made shadows blurry (thru implementing variance mapping)
2016-08-25 hcm Update Skia milestone to 55
2016-08-25 jvanverth Add fat stroke test case to roundrects GM.
2016-08-25 fmalita Revert of Experimental parsing expression grammar (PEG) template library (patchset #8 id:140001 of https://codereview.chromium.org/2271743002/ )
2016-08-25 caryclark add pathops debugging
2016-08-25 anmittal Add neon and crc32 sources for aarch64

BUG= 641478 , 625995 

CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_precise_blink_rel
TBR=bungeman@google.com

Review-Url: https://codereview.chromium.org/2284953003
Cr-Commit-Position: refs/heads/master@{#414892}

[modify] https://crrev.com/6a205ea39d9075faa18bbc13c9d52bd8b1ce938a/DEPS

Project Member

Comment 6 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment