This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

reed, could you please take a look at this security bug in skia? Thanks!

Assigning Skia component is sufficient for triage if an owner is not obvious- we should start with Yuqian due to recent AA changes...

ClusterFuzz has detected this issue as fixed in range 430262:430287.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6372288191791104

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: Heap-buffer-overflow READ 1
Crash Address: 0x60e000039a34
Crash State:
  next
  adjust_row
  operateY
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=430188:430192
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=430262:430287

Minimized Testcase (0.24 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96xNZsGZFaVrcNSr_YrvSebhbivSNFwsfNfOrghBTV9tjDlfR0uBmm1Kenn__CvIETUHuI1dagsH6TYP1KXRG9r1c3zQCSimoKhO7qLP1haiji-I-9CiDFoGOUSwEs2-Ep15D4hc682FMfQIdzkNOq2NizXeQ?testcase_id=6372288191791104

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

https://codereview.chromium.org/2482193004/

The following revision refers to this bug:
  https://skia.googlesource.com/skia.git/+/041da389dd923689041ba5e45cda34901ba4fe8a

commit 041da389dd923689041ba5e45cda34901ba4fe8a
Author: liyuqian <liyuqian@google.com>
Date: Fri Nov 11 17:59:51 2016

Tighten SkAAClip Bounds by Path Bounds

This  bug chromium:662780  exists after our original fix (https://codereview.chromium.org/2477393002/) because this path (added in unit test) is calling blitAntiRect rather than blitAntiH when the path is drifted across the boundary. (The quadratic edge drifts across the boundary after an update and sets a dX=0 line segment which triggers blitAntiRect.)

Note that I didn't assert for the dLeft = dRite = 0 case because the left/right there won't drift after the SkTMin/SkTMax in line 964/966.

Theoretically we can revert the relaxation in https://codereview.chromium.org/2477393002/ (that's only a relaxation for analytic AA, not supersampled AA). However, consider that the initial landing of analytic AA is so painful, I decide to revert that relaxation only after our successful landing...

BUG= chromium:662780 ,  chromium:662862 
GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2482193004

Review-Url: https://codereview.chromium.org/2482193004

[modify] https://crrev.com/041da389dd923689041ba5e45cda34901ba4fe8a/src/core/SkScan_AAAPath.cpp
[modify] https://crrev.com/041da389dd923689041ba5e45cda34901ba4fe8a/tests/PathTest.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d2b4df60de19c7a6bac1364943239a23eef258b3

commit d2b4df60de19c7a6bac1364943239a23eef258b3
Author: skia-deps-roller <skia-deps-roller@chromium.org>
Date: Fri Nov 11 22:07:22 2016

Roll src/third_party/skia/ 38af9438d..857cb97a3 (4 commits).

https://skia.googlesource.com/skia.git/+log/38af9438d7b7..857cb97a34ea

$ git log 38af9438d..857cb97a3 --date=short --no-merges --format='%ad %ae %s'
2016-11-11 scroggo Revert "re-land of skslc now uses standard Skia caps"
2016-11-11 robertphillips Add explicit UniqueID classes for GrGpuResource & GrSurfaceProxy
2016-11-11 ethannicholas re-land of skslc now uses standard Skia caps
2016-11-11 liyuqian Tighten SkAAClip Bounds by Path Bounds

BUG= 662780 , 662862 

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, see:
http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls

CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_precise_blink_rel
TBR=scroggo@google.com

Review-Url: https://codereview.chromium.org/2490313003
Cr-Commit-Position: refs/heads/master@{#431663}

[modify] https://crrev.com/d2b4df60de19c7a6bac1364943239a23eef258b3/DEPS

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot