Incorrect-function-pointer-type in gl::GetGLProcAddress |
|||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5027398145015808 Fuzzer: libfuzzer_gpu_angle_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash Address: Crash State: gl::GetGLProcAddress gl::DriverGL::InitializeStaticBindings gl::InitializeStaticGLBindingsGL Recommended Security Severity: Medium Minimized Testcase (0.00 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv95fyPqccTlysxGrZqKd4tqYQcDXeLfDKVCJxv_hM-uSra1x4q6lLfs1h5_JhZPF5unZ_nort7dHPYqgVGX7anUG1pRbzF_dcMuV9fkXv7GTkI9wRn9X5380kxAayMtf-8282-jLJHDJOur8DqGRYvS80AuE4w?testcase_id=5027398145015808 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Dec 17 2016
,
Dec 20 2016
Can you PTAL or assign this to someone who can? Thanks.
,
Dec 20 2016
,
Dec 21 2016
I can't see how this would be a security issue, but it'd be good to avoid undefined behavior.
,
Dec 21 2016
Incorrect-function-pointer-type bugs can lead to type confusion issues, which are quite dangerous. By default, we mark Incorrect-function-pointer-type as security bugs, because it's not trivial to automatically understand whether type confusion is possible or not. I'm removing other security labels as per c#5.
,
Jan 4 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/7fd0040966be7c3ba0fc0dda7a6b39e91a845906 commit 7fd0040966be7c3ba0fc0dda7a6b39e91a845906 Author: jbauman <jbauman@chromium.org> Date: Wed Jan 04 23:27:11 2017 Change GLGetProcAddress typedef to function returning function pointer This function is actually defined to return function pointers, not void*. It's undefined behavior to call this from a variable of the wrong type. It's also undefined behavior to cast between a function pointer and a void*, so we should try to avoid that. BUG= 675104 CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel Review-Url: https://codereview.chromium.org/2588263005 Cr-Commit-Position: refs/heads/master@{#441505} [modify] https://crrev.com/7fd0040966be7c3ba0fc0dda7a6b39e91a845906/gpu/command_buffer/service/gles2_cmd_decoder_unittest_framebuffers.cc [modify] https://crrev.com/7fd0040966be7c3ba0fc0dda7a6b39e91a845906/ui/gl/generate_bindings.py [modify] https://crrev.com/7fd0040966be7c3ba0fc0dda7a6b39e91a845906/ui/gl/gl_api_unittest.cc [modify] https://crrev.com/7fd0040966be7c3ba0fc0dda7a6b39e91a845906/ui/gl/gl_bindings_autogen_mock.cc [modify] https://crrev.com/7fd0040966be7c3ba0fc0dda7a6b39e91a845906/ui/gl/gl_implementation.cc [modify] https://crrev.com/7fd0040966be7c3ba0fc0dda7a6b39e91a845906/ui/gl/gl_implementation.h [modify] https://crrev.com/7fd0040966be7c3ba0fc0dda7a6b39e91a845906/ui/gl/gl_mock.h [modify] https://crrev.com/7fd0040966be7c3ba0fc0dda7a6b39e91a845906/ui/gl/glx_api_unittest.cc [modify] https://crrev.com/7fd0040966be7c3ba0fc0dda7a6b39e91a845906/ui/gl/wgl_api_unittest.cc [modify] https://crrev.com/7fd0040966be7c3ba0fc0dda7a6b39e91a845906/ui/ozone/platform/cast/surface_factory_cast.cc
,
Jan 4 2017
,
Jan 6 2017
ClusterFuzz has detected this issue as fixed in range 441478:441566. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5027398145015808 Fuzzer: libfuzzer_gpu_angle_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash Address: Crash State: gl::GetGLProcAddress gl::DriverGL::InitializeStaticBindings gl::InitializeStaticGLBindingsGL Sanitizer: undefined (UBSAN) Recommended Security Severity: Medium Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=441478:441566 Minimized Testcase (0.00 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv95fyPqccTlysxGrZqKd4tqYQcDXeLfDKVCJxv_hM-uSra1x4q6lLfs1h5_JhZPF5unZ_nort7dHPYqgVGX7anUG1pRbzF_dcMuV9fkXv7GTkI9wRn9X5380kxAayMtf-8282-jLJHDJOur8DqGRYvS80AuE4w?testcase_id=5027398145015808 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by sheriffbot@chromium.org
, Dec 17 2016