New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 682135 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Feb 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug-Security



Sign in to add a comment

Crash in blink::WebFrameWidgetImpl::handleMouseDown

Project Member Reported by ClusterFuzz, Jan 18 2017

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5008745970270208

Fuzzer: inferno_layout_test_unmodified
Job Type: windows_asan_chrome
Platform Id: windows

Crash Type: UNKNOWN READ
Crash Address: 0xffffffff
Crash State:
  blink::WebFrameWidgetImpl::handleMouseDown
  LinearPipelineContext::~LinearPipelineContext
  SkSmallAllocator<3,NUMBER>::DefaultDestructor<SkA8_Blitter>
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_chrome&range=443909:444176

Minimized Testcase (0.98 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97mTbjqH4jrj7LMtEveHgSTJJh0gmKmCrpAofAEECSlYedt2ZrfhmNf7NMZT_YGdSBrgkOjFUMBwKQ0MQb4VWQvWILa0zCXj2hsI8NQHVlO1CLzPOByBin4QdCeGd0pF5C2VNjbp4Mpz_pGuGfqyjLK_6NE16Yk15GJ5_h0UjKLFaXUCV89_hdtgknmVSMFmG1GWITiU4T-59SFLJaFdojwtnyM_smLMvDqiXkDWH9AED8tNUyZIGkOlUm5bLLhWC8Y3nttmPYXScxN_nNhRre2GJZlS5qL4QTAEsn_37mfgqUQsnnwVBJ14S_FnhMfrvy3d2wGcdnlEJPPUpTRR96_CLg8Nr4Gng1f5HT6gGd0hRw7J4c?testcase_id=5008745970270208

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Project Member

Comment 1 by sheriffbot@chromium.org, Jan 18 2017

Labels: M-57
Project Member

Comment 2 by sheriffbot@chromium.org, Jan 18 2017

Labels: ReleaseBlock-Beta
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 3 by sheriffbot@chromium.org, Jan 18 2017

Labels: Pri-1

Comment 4 by gov...@chromium.org, Jan 23 2017


A friendly reminder that M57 Beta launch is coming soon on February 2nd! Your bug is labelled as Beta ReleaseBlock, pls make sure to land the fix and get it merged into the release branch (2987) ASAP so it gets enough baking time in Dev (before Beta promotion). Thank you!

Comment 5 by est...@chromium.org, Jan 23 2017

Components: Internals>Skia
Owner: reed@chromium.org
Status: Assigned (was: Untriaged)
reed, could you please help find an owner for this security bug? Thanks!

Comment 6 by hcm@chromium.org, Jan 23 2017

Can someone please give me access to the report to be able to triage? thanks
Cc: hcm@chromium.org
Hi hcm@ - I think CCing you on this bug should give you access to the clusterfuzz report.  If not please ping me directly, we're trying to get fixes in by Friday for ReleaseBlock-Beta bugs so want to help solve access issues quickly :-)
Cc: -hcm@chromium.org reed@chromium.org
Owner: hcm@chromium.org
(actually, you might need to be the owner)

Comment 9 by gov...@chromium.org, Jan 25 2017

[Bulk edit]

A friendly reminder that M57 Beta launch is coming soon on February 2nd (in a week)! Your bug is labelled as Beta ReleaseBlock, pls make sure to land the fix and get it merged into the release branch (2987) ASAP so it gets enough baking time in Dev (before Beta promotion). Thank you!
Project Member

Comment 10 by sheriffbot@chromium.org, Jan 26 2017

Labels: -Security_Impact-Head Security_Impact-Beta
Labels: -ReleaseBlock-Beta ReleaseBlock-Stable

Comment 12 by hcm@chromium.org, Feb 1 2017

Cc: hcm@chromium.org
Owner: herb@chromium.org
Herb, is this also a possible side effect of SkArena changes?

Comment 13 by herb@chromium.org, Feb 1 2017

Owner: herb@google.com

Comment 14 by herb@google.com, Feb 1 2017

I think it is, but it is from 1/18/2017. So, I think this was fixed with cl/7418.

Comment 15 by herb@google.com, Feb 1 2017

Status: Fixed (was: Assigned)
Project Member

Comment 16 by sheriffbot@chromium.org, Feb 2 2017

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Labels: -ReleaseBlock-Stable
c/l7418 is issue 683578 - I've requested a merge to M57 over on that bug.
Project Member

Comment 18 by sheriffbot@chromium.org, May 11 2017

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment