New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 683001 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 681792
Owner: ----
Closed: Jan 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Integer-overflow in cubic_delta_from_line

Project Member Reported by ClusterFuzz, Jan 20 2017

Issue description

Cc: lsalz...@mozilla.com brajkumar@chromium.org
Components: Internals>Skia
Labels: Test-Predator-Correct-CLs
Owner: caryclark@chromium.org
Status: Assigned (was: Untriaged)
The result is a list of CLs that change the crashed files. 

Author: Lee Salzman
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/b569056be7d4638598b6ae9f676f077990909931
Time: Fri Jan 13 12:03:24 2017 -0500
File SkScan_Path.cpp is changed in this cl (and is part of stack frame #6, "sk_fill_path"; frame #7, "SkScan::FillPath")
Minimum distance from crash line to modified line: 96. (file: SkScan_Path.cpp, crashed on: 704, modified: 608).

Note: Unable to find the author name in the owners list, so adding reviewer of the file for more updates on this issue.

caryclark@ - Could you please take a look in to this issue?

Owner: caryclark@google.com
Status: Started (was: Assigned)
adding signed integer overflow suppressions to skia
Mergedinto: 681792
Owner: ----
Status: Duplicate (was: Started)
Project Member

Comment 4 by ClusterFuzz, Jan 28 2017

ClusterFuzz has detected this issue as fixed in range 446702:446785.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4579730679660544

Fuzzer: libfuzzer_skia_path_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  cubic_delta_from_line
  SkCubicEdge::setCubicWithoutUpdate
  SkCubicEdge::setCubic
  
Sanitizer: undefined (UBSAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=443818:443834
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=446702:446785

Minimized Testcase (0.05 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96QQ_YV6gRdTgMbN2FGdwP8vcrPP0gp_GB_3suT48UBqfvMDdEY2R1pKIneVuGi656vsBaOkUy9YUNa8EtT0Qurz3zcriWj5jSXzOSCaKm7QZoX-PibDuoDue51KY251eaLhV6DPAZuQlUDdBzCOhKw-s9YZ4PD1LCm27nQj_Yc-5hCZhFIxnCVou4e1SW1wwTkK_jvpOH3rQTor5WdLSR-N7li1c0D1AYHMOwiJsxv2kYMK9OGwLeKeMEC_8iFt_Opzi05Dsa2YseIYcF6_3KQTBfPixkIFde-kZB6Yq_04Kj8BmQovISWVYUesEwrKDNbRpJCB-9rgn-m4wbfUkkwf29z-fWc-CuMKEKIzR56f2y--sQ?testcase_id=4579730679660544

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment