New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 702972 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Last visit > 30 days ago
Closed: Mar 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Integer-overflow in blink::ImageData::create

Project Member Reported by ClusterFuzz, Mar 19 2017

Issue description

Cc: msrchandra@chromium.org
Components: Blink>HTML
Labels: Test-Predator-Correct-CLs M-59
Owner: zakerinasab@chromium.org
Status: Assigned (was: Untriaged)
Assigning to the concern owner from Predator results --
The result is a list of CLs that change the crashed files. 

Author: zakerinasab
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/7fb9535883e50ab0d7262ea8a0e8470934e57a9c
Time: Wed Jan 11 19:09:13 2017
Lines 178-191 of file ImageData.cpp which potentially caused crash are changed in this cl (frame #0, "blink::ImageData::create").
Minimum distance from crash line to modified line: 0. (file: ImageData.cpp, crashed on: 178, modified: 178).

@zakerinasab -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Status: Fixed (was: Assigned)
Project Member

Comment 4 by ClusterFuzz, Mar 22 2017

ClusterFuzz has detected this issue as fixed in range 458546:458585.

Detailed report: https://clusterfuzz.com/testcase?key=5133368145739776

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  blink::ImageData::create
  blink::BaseRenderingContext2D::getImageData
  getImageDataMethod
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=442831:443258
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=458546:458585

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv96SjNicZRunisy_FLOasRSBZzOc0XSBopkWXLy8VRUMBAHZvz5gW96eLZBuwfy0J3J5U2KGyvssHziZQ8Sc6X4g2ruEztLWFUFUQtO1EVhwi_33BEsTNZXs_2rk_5HshIdUNe98IAgP_vgctMVJDLiQsUYP3dg8bXVHFIY3ZDSQ64cIFYNOw7mPN31Afvp1d5qA_irgXZjJ38Y318LvJ0e0mbKVAWI5fcvuQy4Vh9w3hLsk_NchU6G0zOeaBOxF9D_m6eFbmz-b23044x03ETgJCBKegXjIbgmdLupE9YXuN6aAA1qNFv3Sz0hqYAK3vSyjgUywWmKIh-Eq-LiumIaQd55OMORbHq6v6GYoym_NdC33YDWRpyzoiHkibZYMjCLryZTRTFnDi9qe5JOJGIqyyRsevw?testcase_id=5133368145739776


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment