New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 675104 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
not on Chrome anymore
Closed: Jan 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Incorrect-function-pointer-type in gl::GetGLProcAddress

Project Member Reported by ClusterFuzz, Dec 16 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5027398145015808

Fuzzer: libfuzzer_gpu_angle_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Incorrect-function-pointer-type
Crash Address: 
Crash State:
  gl::GetGLProcAddress
  gl::DriverGL::InitializeStaticBindings
  gl::InitializeStaticGLBindingsGL
  
Recommended Security Severity: Medium


Minimized Testcase (0.00 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95fyPqccTlysxGrZqKd4tqYQcDXeLfDKVCJxv_hM-uSra1x4q6lLfs1h5_JhZPF5unZ_nort7dHPYqgVGX7anUG1pRbzF_dcMuV9fkXv7GTkI9wRn9X5380kxAayMtf-8282-jLJHDJOur8DqGRYvS80AuE4w?testcase_id=5027398145015808
 


Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Project Member

Comment 1 by sheriffbot@chromium.org, Dec 17 2016

Labels: M-56
Project Member

Comment 2 by sheriffbot@chromium.org, Dec 17 2016

Labels: Pri-1
Components: UI>GFX
Owner: jbau...@chromium.org
Status: Assigned (was: Untriaged)
Can you PTAL or assign this to someone who can? Thanks.
Components: Internals>GPU>Internals
Labels: -Security_Severity-Medium
Status: Started (was: Assigned)
I can't see how this would be a security issue, but it'd be good to avoid undefined behavior.

Comment 6 by mmoroz@chromium.org, Dec 21 2016

Labels: -Type-Bug-Security -Restrict-View-SecurityTeam -Security_Impact-Stable Type-Bug
Incorrect-function-pointer-type bugs can lead to type confusion issues, which are quite dangerous. By default, we mark Incorrect-function-pointer-type as security bugs, because it's not trivial to automatically understand whether type confusion is possible or not.

I'm removing other security labels as per c#5.
Project Member

Comment 7 by bugdroid1@chromium.org, Jan 4 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7fd0040966be7c3ba0fc0dda7a6b39e91a845906

commit 7fd0040966be7c3ba0fc0dda7a6b39e91a845906
Author: jbauman <jbauman@chromium.org>
Date: Wed Jan 04 23:27:11 2017

Change GLGetProcAddress typedef to function returning function pointer

This function is actually defined to return function pointers, not
void*. It's undefined behavior to call this from a variable of the wrong
type. It's also undefined behavior to cast between a function pointer
and a void*, so we should try to avoid that.

BUG= 675104 
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel

Review-Url: https://codereview.chromium.org/2588263005
Cr-Commit-Position: refs/heads/master@{#441505}

[modify] https://crrev.com/7fd0040966be7c3ba0fc0dda7a6b39e91a845906/gpu/command_buffer/service/gles2_cmd_decoder_unittest_framebuffers.cc
[modify] https://crrev.com/7fd0040966be7c3ba0fc0dda7a6b39e91a845906/ui/gl/generate_bindings.py
[modify] https://crrev.com/7fd0040966be7c3ba0fc0dda7a6b39e91a845906/ui/gl/gl_api_unittest.cc
[modify] https://crrev.com/7fd0040966be7c3ba0fc0dda7a6b39e91a845906/ui/gl/gl_bindings_autogen_mock.cc
[modify] https://crrev.com/7fd0040966be7c3ba0fc0dda7a6b39e91a845906/ui/gl/gl_implementation.cc
[modify] https://crrev.com/7fd0040966be7c3ba0fc0dda7a6b39e91a845906/ui/gl/gl_implementation.h
[modify] https://crrev.com/7fd0040966be7c3ba0fc0dda7a6b39e91a845906/ui/gl/gl_mock.h
[modify] https://crrev.com/7fd0040966be7c3ba0fc0dda7a6b39e91a845906/ui/gl/glx_api_unittest.cc
[modify] https://crrev.com/7fd0040966be7c3ba0fc0dda7a6b39e91a845906/ui/gl/wgl_api_unittest.cc
[modify] https://crrev.com/7fd0040966be7c3ba0fc0dda7a6b39e91a845906/ui/ozone/platform/cast/surface_factory_cast.cc

Status: Fixed (was: Started)
Project Member

Comment 9 by ClusterFuzz, Jan 6 2017

ClusterFuzz has detected this issue as fixed in range 441478:441566.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5027398145015808

Fuzzer: libfuzzer_gpu_angle_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Incorrect-function-pointer-type
Crash Address: 
Crash State:
  gl::GetGLProcAddress
  gl::DriverGL::InitializeStaticBindings
  gl::InitializeStaticGLBindingsGL
  
Sanitizer: undefined (UBSAN)

Recommended Security Severity: Medium

Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=441478:441566

Minimized Testcase (0.00 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95fyPqccTlysxGrZqKd4tqYQcDXeLfDKVCJxv_hM-uSra1x4q6lLfs1h5_JhZPF5unZ_nort7dHPYqgVGX7anUG1pRbzF_dcMuV9fkXv7GTkI9wRn9X5380kxAayMtf-8282-jLJHDJOur8DqGRYvS80AuE4w?testcase_id=5027398145015808
 


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment