New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 675214 link

Starred by 1 user

Issue metadata

Status: Verified
Owner: ----
Closed: Dec 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Float-cast-overflow in poly_coord

Project Member Reported by ClusterFuzz, Dec 16 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6740501853372416

Fuzzer: ochang_search_index_mutator
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  poly_coord
  agg::rasterizer_scanline_aa::add_vertex
  void agg::rasterizer_scanline_aa::add_path_transformed<agg::conv_stroke<agg::pat
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=435261:438085

Minimized Testcase (912.94 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96be-6G0oOPa43GnXZM6EqTkGg3hTP0wq-edJVsRnCFwUgAcrAJ9JoOxFcSEUSPnhsIo67uWOQc_2ZnHKLyXvo-fi_pZMI-ZYFl5qgwl5N452Q7CB5QQzgJ1AYYclEEjoshd5K_qzJbYiw1FR8cKBkhpvGnmd9hjMpV3PVbNNKkj2ynQ0g?testcase_id=6740501853372416

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Components: Internals>Plugins>PDF
Labels: Test-Predator-Correct M-57
Owner: caryclark@chromium.org
Status: Assigned (was: Untriaged)
The result is a list of CLs that change the crashed files. 

Author: caryclark
Project: chromium-pdfium
Changelist: https://pdfium.googlesource.com/pdfium.git/+/8f875507a986d10335e40a5f7c1679aff9770d0a
Time: Tue Dec 06 13:49:34 2016 -0800
Files cfx_renderdevice.cpp, cpdf_renderstatus.cpp are changed in this cl (and is part of stack frame #5, "CFX_RenderDevice::DrawPathWithBlend")
Minimum distance from crash line to modified line: 29. (file: cfx_renderdevice.cpp, crashed on: 593, modified: 622).
Cc: dsinclair@chromium.org caryclark@google.com
Owner: ----
Status: Available (was: Assigned)
I have no knowledge of the code (antigrain) in question.

In time, code I do understand (Skia) eliminates the need for this code, and will resolve this. Until then, if someone else wants to fix the bug in antigrain they should feel free to do so.
Project Member

Comment 3 by ClusterFuzz, Dec 22 2016

ClusterFuzz has detected this issue as fixed in range 440242:440280.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6740501853372416

Fuzzer: ochang_search_index_mutator
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  poly_coord
  agg::rasterizer_scanline_aa::add_vertex
  void agg::rasterizer_scanline_aa::add_path_transformed<agg::conv_stroke<agg::pat
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=435261:438085
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=440242:440280

Minimized Testcase (912.94 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96be-6G0oOPa43GnXZM6EqTkGg3hTP0wq-edJVsRnCFwUgAcrAJ9JoOxFcSEUSPnhsIo67uWOQc_2ZnHKLyXvo-fi_pZMI-ZYFl5qgwl5N452Q7CB5QQzgJ1AYYclEEjoshd5K_qzJbYiw1FR8cKBkhpvGnmd9hjMpV3PVbNNKkj2ynQ0g?testcase_id=6740501853372416

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 4 by ClusterFuzz, Dec 22 2016

Labels: ClusterFuzz-Verified
Status: Verified (was: Available)
ClusterFuzz testcase 6740501853372416 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment