New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 675440 link

Starred by 3 users

Issue metadata

Status: Verified
Owner:
Closed: Dec 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Float-cast-overflow in blink::MouseRelatedEvent::layerY

Project Member Reported by ClusterFuzz, Dec 18 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6367182473920512

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  blink::MouseRelatedEvent::layerY
  layerYAttributeGetter
  blink::MouseEventV8Internal::layerYAttributeGetterCallback
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=435261:438085

Minimized Testcase (0.68 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96EuuLUiDmPniNgb3DdhWDawzeWqQiOtbLID02FwRZAFTEyJ0Ytw169qstA9sgHMnG-D5eTyz_RFccCrzay9gPtX3PdHMsqpfWb3Vzdd-WAmbXmcB3zCsTRS4xwzfqbzcMkVwDEnecXmsPxhrVLZJiD69Gvhg?testcase_id=6367182473920512
<style>
.class2 { -webkit-user-select: none; -webkit-filter: hue-rotate(6deg) }
</style>
<script>
var fakestring = {toString: function() {
return "1" }}
function jsfuzzer() {
try { /* EventHandler*/ var var00001 = htmlvar00026.onmouseleave; } catch(e) { /*console.log();*/ }
 /* WheelEvent*/ var var00016 = document.createEvent("WheelEvent"); 
 /* MouseEvent*/ var var00015 = var00016; 
 var00015.initMouseEvent(); 
 /* boolean*/ var var00039 = htmlvar00008.dispatchEvent(var00015); 
 var00016.initMouseEvent(String.fromCharCode(),false,false,var00001,0,0,-1,1,-2147483648); 
 /* long*/ var var00127 = var00015.layerY; 
}
</script>
<body onload=jsfuzzer()<summary id="htmlvar00008" class="class2"jD">


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 

Comment 1 by tkent@chromium.org, Dec 18 2016

Components: Blink>Input
Cc: msrchandra@chromium.org dtapu...@chromium.org
Labels: Test-Predator-Wrong-CLs
Owner: mustaq@chromium.org
Status: Assigned (was: Untriaged)
Assigning to the concern owner who might have touched the related code.

@mustaq -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Project Member

Comment 3 by ClusterFuzz, Dec 22 2016

ClusterFuzz has detected this issue as fixed in range 440242:440280.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6367182473920512

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  blink::MouseRelatedEvent::layerY
  layerYAttributeGetter
  blink::MouseEventV8Internal::layerYAttributeGetterCallback
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=435261:438085
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=440242:440280

Minimized Testcase (0.68 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96EuuLUiDmPniNgb3DdhWDawzeWqQiOtbLID02FwRZAFTEyJ0Ytw169qstA9sgHMnG-D5eTyz_RFccCrzay9gPtX3PdHMsqpfWb3Vzdd-WAmbXmcB3zCsTRS4xwzfqbzcMkVwDEnecXmsPxhrVLZJiD69Gvhg?testcase_id=6367182473920512
<style>
.class2 { -webkit-user-select: none; -webkit-filter: hue-rotate(6deg) }
</style>
<script>
var fakestring = {toString: function() {
return "1" }}
function jsfuzzer() {
try { /* EventHandler*/ var var00001 = htmlvar00026.onmouseleave; } catch(e) { /*console.log();*/ }
 /* WheelEvent*/ var var00016 = document.createEvent("WheelEvent"); 
 /* MouseEvent*/ var var00015 = var00016; 
 var00015.initMouseEvent(); 
 /* boolean*/ var var00039 = htmlvar00008.dispatchEvent(var00015); 
 var00016.initMouseEvent(String.fromCharCode(),false,false,var00001,0,0,-1,1,-2147483648); 
 /* long*/ var var00127 = var00015.layerY; 
}
</script>
<body onload=jsfuzzer()<summary id="htmlvar00008" class="class2"jD">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 4 by ClusterFuzz, Dec 22 2016

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6367182473920512 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Labels: Hotlist-Input-Dev

Sign in to add a comment