New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 643855 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Last visit > 30 days ago
Closed: Sep 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Integer-overflow in markSpanGone

Project Member Reported by ClusterFuzz, Sep 2 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5542005944090624

Fuzzer: libfuzzer_skia_pathop_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  markSpanGone
  removeSpan
  SkTSect<SkDConic, SkDConic>::extractCoincident
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=407796:407929

Minimized Testcase (0.23 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94l1-Nrs-Q6eZ7ezaCmDjnPYGjE-k6mmb8axQEtw43lNhUYIZQBZbWsiAMeUYFGS0F__32nMy3_b7J2YvWfCkUKPWqEl89KKT4oP07AF_UNPAyfesCrMf4UhLKSwG4uSe9K6_PSNEMp_B8FgBxvw_M6G1joGA?testcase_id=5542005944090624

Issue manually filed by: mummareddy

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Components: Internals>Skia
Labels: Findit-for-crash M-55 Te-Logged
Owner: caryclark@chromium.org
Status: Assigned (was: Untriaged)
From findit tool:

Author: caryclark
Project: chromium-skia
Changelist: https://chromium.googlesource.com/skia.git/+/e25a4f6cbeaccfdc34cf031103f0fbc3e53a3ee5
Time: Tue Jul 26 16:26:29 2016
Lines 30, 38 of file SkPathOpsTSect.cpp which potentially caused crash are changed in this cl (frame #6, "SkIntersections::intersect").
Minimum distance from crash line to modified line: 0. (file: SkPathOpsTSect.cpp, crashed on: 32, modified: 32).

Suspected Project: chromium-skia
Suspected Component: Internals>Skia
Status: Started (was: Assigned)
Project Member

Comment 3 by bugdroid1@chromium.org, Sep 6 2016

The following revision refers to this bug:
  https://skia.googlesource.com/skia.git/+/ef7cee4bbc7c4c1c21b00834de7119634a3c35c9

commit ef7cee4bbc7c4c1c21b00834de7119634a3c35c9
Author: caryclark <caryclark@google.com>
Date: Tue Sep 06 16:05:54 2016

provide safe exit for runaway intersections

Curve intersections with extreme numbers may
cause the intersection template code to loop
forever. Detect this by looking for
marking more spans gone than exist, and
return without any intersections found.

TBR=reed@google.com
BUG= 643855 
GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2310113002

Review-Url: https://codereview.chromium.org/2310113002

[modify] https://crrev.com/ef7cee4bbc7c4c1c21b00834de7119634a3c35c9/src/pathops/SkPathOpsTSect.h
[modify] https://crrev.com/ef7cee4bbc7c4c1c21b00834de7119634a3c35c9/tests/PathOpsOpTest.cpp

Owner: caryclark@google.com
Project Member

Comment 5 by bugdroid1@chromium.org, Sep 6 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/38994ad4f5c7334d0b2d510f8411674183abc826

commit 38994ad4f5c7334d0b2d510f8411674183abc826
Author: skia-deps-roller <skia-deps-roller@chromium.org>
Date: Tue Sep 06 20:50:27 2016

Roll src/third_party/skia/ f54c00e81..6669010af (9 commits).

https://chromium.googlesource.com/skia.git/+log/f54c00e817b1..6669010af4e6

$ git log f54c00e81..6669010af --date=short --no-merges --format='%ad %ae %s'
2016-09-06 reed check for null-layer-paint after prev fix to savelayer ops
2016-09-06 msarett Delete SkColorSpace::kUnknown_Named, remove fNamed field
2016-09-06 csmartdalton Improve usage of window rectangles
2016-09-06 brucedawson Work around VS 2015 Update 3 optimizer internal compiler error
2016-09-06 halcanary SkDocument: turn off SK_SUPPORT_LEGACY_DOCUMENT_API
2016-09-06 reed test dont-clip-layer
2016-09-06 caryclark provide safe exit for runaway intersections
2016-09-06 caryclark compare degenerates with tolerance
2016-09-06 bsalomon Update Windows build to use VULKAN_SDK rather than VK_SDK_PATH

BUG= 643855 , 643933 , 643665 

CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_precise_blink_rel
TBR=caryclark@google.com

Review-Url: https://codereview.chromium.org/2312993002
Cr-Commit-Position: refs/heads/master@{#416722}

[modify] https://crrev.com/38994ad4f5c7334d0b2d510f8411674183abc826/DEPS

Status: Fixed (was: Started)
Project Member

Comment 7 by ClusterFuzz, Sep 7 2016

ClusterFuzz has detected this issue as fixed in range 416688:416774.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5542005944090624

Fuzzer: libfuzzer_skia_pathop_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  markSpanGone
  removeSpan
  SkTSect<SkDConic, SkDConic>::extractCoincident
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=407796:407929
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=416688:416774

Minimized Testcase (0.23 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94l1-Nrs-Q6eZ7ezaCmDjnPYGjE-k6mmb8axQEtw43lNhUYIZQBZbWsiAMeUYFGS0F__32nMy3_b7J2YvWfCkUKPWqEl89KKT4oP07AF_UNPAyfesCrMf4UhLKSwG4uSe9K6_PSNEMp_B8FgBxvw_M6G1joGA?testcase_id=5542005944090624

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment