New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 710416 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 709941
Owner: ----
Closed: Apr 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 1
Type: Bug-Security



Sign in to add a comment

Heap-buffer-overflow in SkColorLookUpTable::interp3D

Project Member Reported by ClusterFuzz, Apr 11 2017

Issue description

Project Member

Comment 1 by ClusterFuzz, Apr 11 2017

Labels: OS-Linux
Project Member

Comment 2 by sheriffbot@chromium.org, Apr 11 2017

Labels: M-59
Project Member

Comment 3 by sheriffbot@chromium.org, Apr 11 2017

Labels: ReleaseBlock-Beta
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 4 by sheriffbot@chromium.org, Apr 11 2017

Labels: Pri-1
 Issue 709941  ?
Cc: msar...@google.com mtklein@chromium.org
Components: Internals>Skia
mtklein -- Can you take a look? This is from a newly added fuzzer:  http://crbug.com/708016 

Mergedinto: 709941
Status: Duplicate (was: Untriaged)
Odds are, a dup!

Think we can get that bot less confused?  If this is from a new fuzzer, odds are this has been around longer than M59 and it doesn't really make sense to block its release.  This sort of thing comes up all the time when someone adds a new fuzzer and it really affects our willingness to help fix things and general morale.
Project Member

Comment 8 by ClusterFuzz, May 6 2017

ClusterFuzz has detected this issue as fixed in range 469664:469699.

Detailed report: https://clusterfuzz.com/testcase?key=4784208192208896

Fuzzer: libfuzzer_skia_color_space_fuzzer
Job Type: mac_libfuzzer_chrome_asan
Platform Id: mac

Crash Type: Heap-buffer-overflow READ 4
Crash Address: 0x60500000d7b4
Crash State:
  SkColorLookUpTable::interp3D
  SkColorLookUpTable::interp
  color_lookup_table
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=463138:463173
Fixed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=469664:469699

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4784208192208896


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by sheriffbot@chromium.org, Jul 20 2017

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment