New issue
Advanced search Search tips

Issue 656936 link

Starred by 1 user
Status: WontFix
Owner:
mbarbe...@chromium.org
Closed: Dec 2016
Cc:
attek...@gmail.com
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug-Security



Sign in to add a comment

Heap-buffer-overflow in _get_bitmap_surface

Project Member Reported by ClusterFuzz, Oct 18 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6505068310560768

Fuzzer: attekett_dom_fuzzer
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: Heap-buffer-overflow READ 4
Crash Address: 0x6040012d447c
Crash State:
  _get_bitmap_surface
  
Recommended Security Severity: Low

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=297214:297254

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96jhb9aMKdVAAqHVNnS8uSUddT0KPB4BvohMFMibm_-3lznSDTaeAzA8ul3ohLPwbsV1eARHOZlygF_GMhkb3Dc7-T6bxhitxR8w5B_gBTxezLrYLP7uMW8y7nnQ26hc4MKl3r7Xs3OHlqMNCVIHBXLZZFxV71-QTPrITIHDxzg_rme4jk?testcase_id=6505068310560768


Additional requirements: Requires Gestures

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Project Member

Comment 1 by sheriffbot@chromium.org, Oct 18 2016

Labels: Pri-2

Comment 2 by mbarbe...@chromium.org, Oct 24 2016

Owner: mbarbe...@chromium.org
Status: Assigned (was: Untriaged)
This may just be an issue with the version of freetype we're using for testing. I'll confirm soon.

Comment 3 by mbarbe...@chromium.org, Oct 24 2016

Components: Internals
Project Member

Comment 4 by ClusterFuzz, Dec 10 2016

Status: WontFix (was: Assigned)
ClusterFuzz testcase 6505068310560768 is flaky and no longer reproduces, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 5 by sheriffbot@chromium.org, Dec 10 2016

Labels: -reward-topanel reward-ineligible
Project Member

Comment 6 by sheriffbot@chromium.org, Mar 18 2017

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment