New issue
Advanced search Search tips

Issue 658585 link

Starred by 1 user
Status: Fixed
Owner:
e...@chromium.org
Closed: Oct 2016
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug



Sign in to add a comment

Crash in blink::SVGLengthContext::convertValueFromEXSToUserUnits

Project Member Reported by ClusterFuzz, Oct 23 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5239280513581056

Fuzzer: inferno_twister_custom_bundle
Job Type: windows_syzyasan_chrome
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000023
Crash State:
  blink::SVGLengthContext::convertValueFromEXSToUserUnits
  blink::SVGLengthContext::convertValueToUserUnits
  blink::SVGLength::value
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_chrome&range=425442:425517

Minimized Testcase (4.79 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95Wx_jl7r9UoHgnFrx2SntDsqPVrdnNhb_L195e8tM_IEykNFUC7pCQDFtKCidU9g34kUh1__TqqfFCMfwjztrkCcTNnAMBVe1PCwjY9CqRAe-9yySf-cLnZWtQml9na8tXNTsQD-wWA283eouVFpQWYQJFyA?testcase_id=5239280513581056

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by durga.behera@chromium.org, Oct 24 2016

Components: Blink>SVG
Owner: e...@chromium.org
Status: Assigned (was: Untriaged)
Suspected CLs	
==============
Findit could not find any suspected CLs.

Suspected Project: chromium

From code search on the file "SVGLengthContext.cpp" suspecting the below.
https://chromiumcodereview.appspot.com/2445463002
eae@ : Could you please take a look into this if its related to your change.

Comment 2 by e...@chromium.org, Oct 24 2016

Status: Fixed (was: Assigned)
Project Member

Comment 3 by bugdroid1@chromium.org, Oct 24 2016 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4c55d78bcbaff133a4e688eddc7573e0609cf190

commit 4c55d78bcbaff133a4e688eddc7573e0609cf190
Author: fs <fs@opera.com>
Date: Mon Oct 24 16:18:24 2016

Fix more null-checks in SVGLengthContext::convertValueFrom*

The following methods in SVGLengthContext:

 convertValueFromUserUnitsToCHS
 convertValueFromUserUnitsToEXS
 convertValueFromEXSToUserUnits

needs the same treatment as convertValueFromCHSToUserUnits got in
https://chromiumcodereview.appspot.com/2445463002.

R=pdr@chromium.org,eae@chromium.org
BUG= 657438 , 658585 , 658613 

Review-Url: https://codereview.chromium.org/2449433002
Cr-Commit-Position: refs/heads/master@{#427080}

[modify] https://crrev.com/4c55d78bcbaff133a4e688eddc7573e0609cf190/third_party/WebKit/Source/core/svg/SVGLengthContext.cpp
Project Member

Comment 4 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment