Heap-buffer-overflow in blink::TextRun::codepointAtAndNext |
||||||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=6531355262582784 Fuzzer: inferno_twister Job Type: mac_asan_chrome Platform Id: mac Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x60a00017c812 Crash State: blink::TextRun::codepointAtAndNext blink::CachingWordShapeIterator::nextWordEndIndex blink::CachingWordShapeIterator::next Sanitizer: address (ASAN) Recommended Security Severity: Medium Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=448729:448967 Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96IevhPfFIudt0zAx6NNcvBviknyZKl3oiR3djWe6-cFMlozTMhsSYzVwtFgQLvs_GfOaqduSBJKnpb5xy8FEZ2GglKLcjHzJsBHCmbaBvVZh0emb3-WzW0teE_fPvOmfFAl6MozwddUFc2G5BTCRKNc5_vcuAPkZrvxrifhkMzEDYnGBHJTSlIZM18OizBvFGrEHyXm9Mceh2lf92FLqNcn6fT0-kLX41WU4rcerBi2XXX6ZnOB3PzoJeqguOH2lnX1A0zvUlZTvScaHyTUJSckuPo-WhPIM06xx8akgMSgrOgdOMz_giAu2IwauTUUlvr_oojqdJ_aXxKnVbJ0R2BOxZloAZI7FeTwBO7ijmrS9LX5NQScfj-7njNa4-PDvBjQaBg66Iz-tPXbCwKtpTia0REsA?testcase_id=6531355262582784 Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Feb 9 2017
This is in text rendering area. eae@, would you assign a proper owner please?
,
Feb 9 2017
Thanks tkent.
,
Feb 9 2017
,
Feb 9 2017
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Feb 9 2017
,
Feb 9 2017
,
Feb 10 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/357719bae98584d89410828312d37fe6cdc15b03 commit 357719bae98584d89410828312d37fe6cdc15b03 Author: eae <eae@chromium.org> Date: Fri Feb 10 02:58:39 2017 Have codePointAt DCHECKS apply to 8bit strings too BUG= 690218 R=szager@chromium.org Review-Url: https://codereview.chromium.org/2691443002 Cr-Commit-Position: refs/heads/master@{#449540} [modify] https://crrev.com/357719bae98584d89410828312d37fe6cdc15b03/third_party/WebKit/Source/platform/text/TextRun.h
,
Feb 14 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/c02f2614dc7eb919b2cdb5b3b6cd5a54199e815f commit c02f2614dc7eb919b2cdb5b3b6cd5a54199e815f Author: eae <eae@chromium.org> Date: Tue Feb 14 22:36:21 2017 Fix handling of malformed surrogate pairs for break-all BUG= 690218 R=cbiesinger@chromium.org Review-Url: https://codereview.chromium.org/2691163003 Cr-Commit-Position: refs/heads/master@{#450496} [modify] https://crrev.com/c02f2614dc7eb919b2cdb5b3b6cd5a54199e815f/third_party/WebKit/Source/core/layout/LayoutText.cpp [modify] https://crrev.com/c02f2614dc7eb919b2cdb5b3b6cd5a54199e815f/third_party/WebKit/Source/core/layout/TextRunConstructor.cpp
,
Feb 15 2017
ClusterFuzz has detected this issue as fixed in range 450446:450496. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6531355262582784 Fuzzer: inferno_twister Job Type: mac_asan_chrome Platform Id: mac Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x60a000180374 Crash State: blink::TextRun::codepointAtAndNext blink::CachingWordShapeIterator::nextWordEndIndex blink::CachingWordShapeIterator::next Sanitizer: address (ASAN) Recommended Security Severity: Medium Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=448729:448967 Fixed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=450446:450496 Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96j-vgVnSPN6Cm2J0f7X3Y9tmSl9w3fxcqDJFEDI13FXB40443Stb5rIM9-kRGfyo-DJcxKHL4Z-K6Dy_BmuuraEF1khwkp2D9aTyQANv7odhL3laSjtBz4hO95NuUtbEBvxUFhd6_DDI01n-cAP3rdBDfx1ahxbPgXb2BJOdcC-ugod9od-0BHWbCMalXkkyZy7I0ntlS9C4V9xC3bLwz7AwchTuQZqXPQgjLg2urMPL2Ls4wpdKjU9kGM_1uaDRV4dnR9XgwzmoQpUKjjh0BMq5FEHA9IxEFgWDvqntFyJWwmWSR3Z7s2ZVDp9ci12r9xzDLEbOBouz1pSWRwTj5_gIp2qZ002kShDuEHkwnSHg-BTjGtLvEOIAcckq_BHIb1Rxv_NssUE-DO9mzwT-sNA_UAsw?testcase_id=6531355262582784 See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Feb 15 2017
ClusterFuzz testcase 6531355262582784 is verified as fixed, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Feb 15 2017
,
Mar 13 2017
,
May 24 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
||||||||||
►
Sign in to add a comment |
||||||||||
Comment 1 by palmer@chromium.org
, Feb 9 2017Components: Blink
Labels: OS-Android OS-Chrome OS-Linux OS-Windows
Owner: jochen@chromium.org
Status: Assigned (was: Untriaged)