Crash in SkImageFilter::~SkImageFilter |
||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=6197310591860736 Fuzzer: sugoi_filter_fuzzer Job Type: linux_asan_filter_fuzz_stub Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x000000000008 Crash State: SkImageFilter::~SkImageFilter SkMatrixConvolutionImageFilter::~SkMatrixConvolutionImageFilter SkMergeImageFilter::CreateProc Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_filter_fuzz_stub&range=390115:390221 Minimized Testcase (1.03 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96bKFUWJDPuAhMgMfoieeiEUoYYC-8PFQ-uEUs8WDGgSJWMKoi_HEA-EQ4Xzf1e24SmAJpllQeFipoDYuNK49a8SpJTtqGWGZNV-OQut42mF8aecvh3fYvLYut5teACfcc6Zuq33iSllqM3YJvaZtiz4N_HVw?testcase_id=6197310591860736 Issue manually filed by: mmohammad See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Sep 13 2016
Speculation: this is a memory allocation failure, and the fuzzer is not compiled with the correct flags, and malloc() is returning null rather than crashing as it does in Chrome (there are a number of similar reports related to filter_fuzz_stub, but I can't find them right now). I.e., the filter may be vulnerable, but Chrome is not.
,
Sep 13 2016
That should read "the fuzzer may be vulnerable".
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jan 23 2017
Since this only affects the fuzzer, I'm lowering the priority.
,
Jul 13 2017
ClusterFuzz has detected this issue as fixed in range 485950:486005. Detailed report: https://clusterfuzz.com/testcase?key=6197310591860736 Fuzzer: sugoi_filter_fuzzer Job Type: linux_asan_filter_fuzz_stub Platform Id: linux Crash Type: Null-dereference WRITE Crash Address: 0x000000000008 Crash State: SkImageFilter::~SkImageFilter SkMatrixConvolutionImageFilter::~SkMatrixConvolutionImageFilter SkMergeImageFilter::CreateProc Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_filter_fuzz_stub&range=390115:390221 Fixed: https://clusterfuzz.com/revisions?job=linux_asan_filter_fuzz_stub&range=485950:486005 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6197310591860736 See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jul 13 2017
ClusterFuzz testcase 6197310591860736 is verified as fixed, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Jan 22 2018
|
||||||
►
Sign in to add a comment |
||||||
Comment 1 by mmohammad@chromium.org
, Sep 6 2016Status: Assigned (was: Untriaged)