New issue
Advanced search Search tips

Issue 696623 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Apr 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security



Sign in to add a comment

Use-of-uninitialized-value in sse41::blit_row_s32a_opaque

Project Member Reported by ClusterFuzz, Feb 27 2017

Issue description

Components: Internals>Skia
Owner: bsalomon@chromium.org
Status: Assigned (was: Untriaged)
Can you please take a look or assign this to someone who can? Thank you.
Owner: reed@google.com
Assigning to reed@ for investigation or delegation
Project Member

Comment 3 by sheriffbot@chromium.org, Feb 28 2017

Labels: M-57
Project Member

Comment 4 by sheriffbot@chromium.org, Feb 28 2017

Labels: Pri-1
Project Member

Comment 5 by sheriffbot@chromium.org, Mar 14 2017

reed: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 6 by sheriffbot@chromium.org, Mar 28 2017

reed: Uh oh! This issue still open and hasn't been updated in the last 28 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 7 by hcm@chromium.org, Mar 28 2017

Cc: reed@google.com
Owner: hcm@chromium.org
(ownership gymnastics to be able to see the report in reed's absence)

Comment 8 by hcm@chromium.org, Mar 28 2017

Cc: hcm@chromium.org
Owner: fmalita@chromium.org
Florin, can you take a look at this one- wondering if it may be related to some of the draw rect changes made around https://codereview.chromium.org/2286873002

Comment 10 by hcm@chromium.org, Mar 28 2017

Agree, the regression range doesn't seem to reveal any related changes
Project Member

Comment 11 by ClusterFuzz, Apr 1 2017

ClusterFuzz has detected this issue as fixed in range 461223:461266.

Detailed report: https://clusterfuzz.com/testcase?key=4819753484156928

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_msan_chrome
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  sse41::blit_row_s32a_opaque
  Sprite_D32_S32::blitRect
  SkScan::FillIRect
  
Sanitizer: memory (MSAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=linux_msan_chrome&range=411957:412168
Fixed: https://clusterfuzz.com/revisions?job=linux_msan_chrome&range=461223:461266

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv957md3BU3x31jD2Vq8b9sSkVJJhhGTwQD4k_2aHkMCMqKsaV0HyZ9nT-YIHeSsO3csCT-kYrXFNaSynDvFMxfhyabTOAVQFqlgYiYj2rFOfZalm0IeLQsw4GUQmS_sunGl8sqiRdMKeNI9sGCj7_5vIxYi_ufzYDeMh82XmudcQVHYMypRQCerZtmNUGNA82Bj9rvRb6xJFY7iboJ0G_jvoB_cj_jAJd9T-iCiU_9_Azhq-W5GZ4MHMhKrDqZojs5StBYTfuxGkYp1qmjPvGm6HQrfyNXOmWEdipvS-vTn16_BsnhxeNgTyIr-9cv71NTw8PAyC1qe7xveqbiwin3N5uePyho3hsjNE6xxXUlD6UyCJ4B4?testcase_id=4819753484156928


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 12 by ClusterFuzz, Apr 1 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 4819753484156928 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 13 by sheriffbot@chromium.org, Apr 1 2017

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 14 by sheriffbot@chromium.org, Jul 8 2017

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment