Integer-overflow in agg::outline_aa::render_line |
|||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=6555220601733120 Fuzzer: tokenfuzz_pdf_march16 Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: agg::outline_aa::render_line agg::outline_aa::line_to agg::rasterizer_scanline_aa::line_to_no_clip Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=370022:370027 Minimized Testcase (96.85 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96k35WeZWz6i8Iy6Y_vb4ssmizLyUviOgr_BmsbyFy4xYFgZwuwIa88OklER3SS3Sa62N8Y-g5Q-0KLxMrhLfKY7O1OJk2OPifP3vs3g_gpZRBwqdzM_Hfi2zym8nyjadv1yUHmWp_x-sDG-JptxtgOKr5BWhsDLAM9mQ_745KO2in7Exg?testcase_id=6555220601733120 Issue manually filed by: mummareddy See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Sep 14 2016
,
Sep 15 2016
,
Sep 15 2016
The following revision refers to this bug: https://pdfium.googlesource.com/pdfium.git/+/4935e606c632e38af8fca1729f8688fa0d152b90 commit 4935e606c632e38af8fca1729f8688fa0d152b90 Author: dsinclair <dsinclair@chromium.org> Date: Thu Sep 15 19:21:39 2016 Use safe math when rendering line segments in AGG. It is possible for the calculations in outline_aa::render_line to overflow as the |p| variable is calculated. This Cl updates the routine to use checked math when calculating the value of |p|. BUG= chromium:647026 Review-Url: https://codereview.chromium.org/2347603002 [add] https://crrev.com/4935e606c632e38af8fca1729f8688fa0d152b90/third_party/agg23/0003-ubsan-render-line-error.patch [modify] https://crrev.com/4935e606c632e38af8fca1729f8688fa0d152b90/third_party/agg23/README.pdfium [modify] https://crrev.com/4935e606c632e38af8fca1729f8688fa0d152b90/third_party/agg23/agg_rasterizer_scanline_aa.cpp
,
Sep 15 2016
The following revision refers to this bug: https://pdfium.googlesource.com/pdfium.git/+/4935e606c632e38af8fca1729f8688fa0d152b90 commit 4935e606c632e38af8fca1729f8688fa0d152b90 Author: dsinclair <dsinclair@chromium.org> Date: Thu Sep 15 19:21:39 2016 Use safe math when rendering line segments in AGG. It is possible for the calculations in outline_aa::render_line to overflow as the |p| variable is calculated. This Cl updates the routine to use checked math when calculating the value of |p|. BUG= chromium:647026 Review-Url: https://codereview.chromium.org/2347603002 [add] https://crrev.com/4935e606c632e38af8fca1729f8688fa0d152b90/third_party/agg23/0003-ubsan-render-line-error.patch [modify] https://crrev.com/4935e606c632e38af8fca1729f8688fa0d152b90/third_party/agg23/README.pdfium [modify] https://crrev.com/4935e606c632e38af8fca1729f8688fa0d152b90/third_party/agg23/agg_rasterizer_scanline_aa.cpp
,
Sep 15 2016
,
Sep 15 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/29fa519d43d70d5816c296f174154894ae063dc4 commit 29fa519d43d70d5816c296f174154894ae063dc4 Author: pdfium-deps-roller <pdfium-deps-roller@chromium.org> Date: Thu Sep 15 22:06:18 2016 Roll src/third_party/pdfium/ 8f53f54a9..0a17fafd7 (6 commits). https://pdfium.googlesource.com/pdfium.git/+log/8f53f54a9cca..0a17fafd723e $ git log 8f53f54a9..0a17fafd7 --date=short --no-merges --format='%ad %ae %s' 2016-09-15 tonikitoo Use either /RECT or /QuadPoints for annotation coordinates, depending on /AP 2016-09-15 npm Use ToUnicode mapping even when unicode is 0. 2016-09-15 npm Deleted unused defintions and methods from PWL_FontMap 2016-09-15 dsinclair Cleanup CFX_SystemHandler. 2016-09-15 dsinclair Use safe math when rendering line segments in AGG. 2016-09-15 dsinclair Replace FX_UINT with unsigned int BUG= 647026 TBR=dsinclair@chromium.org Review-Url: https://codereview.chromium.org/2342113002 Cr-Commit-Position: refs/heads/master@{#419003} [modify] https://crrev.com/29fa519d43d70d5816c296f174154894ae063dc4/DEPS
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by mummare...@chromium.org
, Sep 14 2016Labels: M-54 findit-wrong Te-Logged
Owner: npm@chromium.org
Status: Assigned (was: Untriaged)