Integer-overflow in markSpanGone |
|||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5542005944090624 Fuzzer: libfuzzer_skia_pathop_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: markSpanGone removeSpan SkTSect<SkDConic, SkDConic>::extractCoincident Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=407796:407929 Minimized Testcase (0.23 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94l1-Nrs-Q6eZ7ezaCmDjnPYGjE-k6mmb8axQEtw43lNhUYIZQBZbWsiAMeUYFGS0F__32nMy3_b7J2YvWfCkUKPWqEl89KKT4oP07AF_UNPAyfesCrMf4UhLKSwG4uSe9K6_PSNEMp_B8FgBxvw_M6G1joGA?testcase_id=5542005944090624 Issue manually filed by: mummareddy See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Sep 6 2016
,
Sep 6 2016
The following revision refers to this bug: https://skia.googlesource.com/skia.git/+/ef7cee4bbc7c4c1c21b00834de7119634a3c35c9 commit ef7cee4bbc7c4c1c21b00834de7119634a3c35c9 Author: caryclark <caryclark@google.com> Date: Tue Sep 06 16:05:54 2016 provide safe exit for runaway intersections Curve intersections with extreme numbers may cause the intersection template code to loop forever. Detect this by looking for marking more spans gone than exist, and return without any intersections found. TBR=reed@google.com BUG= 643855 GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2310113002 Review-Url: https://codereview.chromium.org/2310113002 [modify] https://crrev.com/ef7cee4bbc7c4c1c21b00834de7119634a3c35c9/src/pathops/SkPathOpsTSect.h [modify] https://crrev.com/ef7cee4bbc7c4c1c21b00834de7119634a3c35c9/tests/PathOpsOpTest.cpp
,
Sep 6 2016
,
Sep 6 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/38994ad4f5c7334d0b2d510f8411674183abc826 commit 38994ad4f5c7334d0b2d510f8411674183abc826 Author: skia-deps-roller <skia-deps-roller@chromium.org> Date: Tue Sep 06 20:50:27 2016 Roll src/third_party/skia/ f54c00e81..6669010af (9 commits). https://chromium.googlesource.com/skia.git/+log/f54c00e817b1..6669010af4e6 $ git log f54c00e81..6669010af --date=short --no-merges --format='%ad %ae %s' 2016-09-06 reed check for null-layer-paint after prev fix to savelayer ops 2016-09-06 msarett Delete SkColorSpace::kUnknown_Named, remove fNamed field 2016-09-06 csmartdalton Improve usage of window rectangles 2016-09-06 brucedawson Work around VS 2015 Update 3 optimizer internal compiler error 2016-09-06 halcanary SkDocument: turn off SK_SUPPORT_LEGACY_DOCUMENT_API 2016-09-06 reed test dont-clip-layer 2016-09-06 caryclark provide safe exit for runaway intersections 2016-09-06 caryclark compare degenerates with tolerance 2016-09-06 bsalomon Update Windows build to use VULKAN_SDK rather than VK_SDK_PATH BUG= 643855 , 643933 , 643665 CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_precise_blink_rel TBR=caryclark@google.com Review-Url: https://codereview.chromium.org/2312993002 Cr-Commit-Position: refs/heads/master@{#416722} [modify] https://crrev.com/38994ad4f5c7334d0b2d510f8411674183abc826/DEPS
,
Sep 6 2016
,
Sep 7 2016
ClusterFuzz has detected this issue as fixed in range 416688:416774. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5542005944090624 Fuzzer: libfuzzer_skia_pathop_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: markSpanGone removeSpan SkTSect<SkDConic, SkDConic>::extractCoincident Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=407796:407929 Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=416688:416774 Minimized Testcase (0.23 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94l1-Nrs-Q6eZ7ezaCmDjnPYGjE-k6mmb8axQEtw43lNhUYIZQBZbWsiAMeUYFGS0F__32nMy3_b7J2YvWfCkUKPWqEl89KKT4oP07AF_UNPAyfesCrMf4UhLKSwG4uSe9K6_PSNEMp_B8FgBxvw_M6G1joGA?testcase_id=5542005944090624 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by mummare...@chromium.org
, Sep 2 2016Labels: Findit-for-crash M-55 Te-Logged
Owner: caryclark@chromium.org
Status: Assigned (was: Untriaged)