New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 647026 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Sep 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Integer-overflow in agg::outline_aa::render_line

Project Member Reported by ClusterFuzz, Sep 14 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6555220601733120

Fuzzer: tokenfuzz_pdf_march16
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  agg::outline_aa::render_line
  agg::outline_aa::line_to
  agg::rasterizer_scanline_aa::line_to_no_clip
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=370022:370027

Minimized Testcase (96.85 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96k35WeZWz6i8Iy6Y_vb4ssmizLyUviOgr_BmsbyFy4xYFgZwuwIa88OklER3SS3Sa62N8Y-g5Q-0KLxMrhLfKY7O1OJk2OPifP3vs3g_gpZRBwqdzM_Hfi2zym8nyjadv1yUHmWp_x-sDG-JptxtgOKr5BWhsDLAM9mQ_745KO2in7Exg?testcase_id=6555220601733120

Issue manually filed by: mummareddy

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Components: Internals>Plugins>PDF
Labels: M-54 findit-wrong Te-Logged
Owner: npm@chromium.org
Status: Assigned (was: Untriaged)
Author: npm
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/9ada2d83cbb629f286936ebc7a208a61164f873b
Time: Wed Aug 10 07:51:38 2016 -0700
The CL last changed line 612 of file cfx_renderdevice.cpp, which is stack frame 6.

Suspected Project: chromium-pdfium

npm@, could you please take a look and please help us to find correct owner if it is not related your changes.

Comment 2 by npm@chromium.org, Sep 14 2016

Owner: dsinclair@chromium.org
Status: Started (was: Assigned)
Project Member

Comment 4 by bugdroid1@chromium.org, Sep 15 2016

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium.git/+/4935e606c632e38af8fca1729f8688fa0d152b90

commit 4935e606c632e38af8fca1729f8688fa0d152b90
Author: dsinclair <dsinclair@chromium.org>
Date: Thu Sep 15 19:21:39 2016

Use safe math when rendering line segments in AGG.

It is possible for the calculations in outline_aa::render_line to overflow
as the |p| variable is calculated. This Cl updates the routine to use
checked math when calculating the value of |p|.

BUG= chromium:647026 

Review-Url: https://codereview.chromium.org/2347603002

[add] https://crrev.com/4935e606c632e38af8fca1729f8688fa0d152b90/third_party/agg23/0003-ubsan-render-line-error.patch
[modify] https://crrev.com/4935e606c632e38af8fca1729f8688fa0d152b90/third_party/agg23/README.pdfium
[modify] https://crrev.com/4935e606c632e38af8fca1729f8688fa0d152b90/third_party/agg23/agg_rasterizer_scanline_aa.cpp

Project Member

Comment 5 by bugdroid1@chromium.org, Sep 15 2016

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium.git/+/4935e606c632e38af8fca1729f8688fa0d152b90

commit 4935e606c632e38af8fca1729f8688fa0d152b90
Author: dsinclair <dsinclair@chromium.org>
Date: Thu Sep 15 19:21:39 2016

Use safe math when rendering line segments in AGG.

It is possible for the calculations in outline_aa::render_line to overflow
as the |p| variable is calculated. This Cl updates the routine to use
checked math when calculating the value of |p|.

BUG= chromium:647026 

Review-Url: https://codereview.chromium.org/2347603002

[add] https://crrev.com/4935e606c632e38af8fca1729f8688fa0d152b90/third_party/agg23/0003-ubsan-render-line-error.patch
[modify] https://crrev.com/4935e606c632e38af8fca1729f8688fa0d152b90/third_party/agg23/README.pdfium
[modify] https://crrev.com/4935e606c632e38af8fca1729f8688fa0d152b90/third_party/agg23/agg_rasterizer_scanline_aa.cpp

Status: Fixed (was: Started)
Project Member

Comment 7 by bugdroid1@chromium.org, Sep 15 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/29fa519d43d70d5816c296f174154894ae063dc4

commit 29fa519d43d70d5816c296f174154894ae063dc4
Author: pdfium-deps-roller <pdfium-deps-roller@chromium.org>
Date: Thu Sep 15 22:06:18 2016

Roll src/third_party/pdfium/ 8f53f54a9..0a17fafd7 (6 commits).

https://pdfium.googlesource.com/pdfium.git/+log/8f53f54a9cca..0a17fafd723e

$ git log 8f53f54a9..0a17fafd7 --date=short --no-merges --format='%ad %ae %s'
2016-09-15 tonikitoo Use either /RECT or /QuadPoints for annotation coordinates, depending on /AP
2016-09-15 npm Use ToUnicode mapping even when unicode is 0.
2016-09-15 npm Deleted unused defintions and methods from PWL_FontMap
2016-09-15 dsinclair Cleanup CFX_SystemHandler.
2016-09-15 dsinclair Use safe math when rendering line segments in AGG.
2016-09-15 dsinclair Replace FX_UINT with unsigned int

BUG= 647026 

TBR=dsinclair@chromium.org

Review-Url: https://codereview.chromium.org/2342113002
Cr-Commit-Position: refs/heads/master@{#419003}

[modify] https://crrev.com/29fa519d43d70d5816c296f174154894ae063dc4/DEPS

Project Member

Comment 8 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment