This looks like a use of uninitialised value in Harfbuzz itself rather than in Chrome code. +behdad, +eae, do you mind following up?

Security issue in harfbuzz, over to behdad. Let me know if you need any help behdad.

behdad: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This is https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=757.

behdad@, can you please harfbuzz on chromium to latest.

I'll roll HB.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d90b34b2c01631495508bd595a17dbe60fe061c6

commit d90b34b2c01631495508bd595a17dbe60fe061c6
Author: eae <eae@chromium.org>
Date: Tue May 02 22:57:03 2017

Roll HarfBuzz to 1.4.6

TBR=drott@chromium.org
BUG= 712163 

Review-Url: https://codereview.chromium.org/2858683002
Cr-Commit-Position: refs/heads/master@{#468807}

[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/BUILD.gn
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/NEWS
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/README.chromium
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-buffer-serialize.cc
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-common.cc
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-coretext.cc
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-face-private.hh
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-face.cc
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-fallback-shape.cc
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-font-private.hh
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-font.cc
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-font.h
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-graphite2.cc
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-graphite2.h
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-ot-layout-gsubgpos-private.hh
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-ot-layout-private.hh
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-ot-layout.cc
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-ot-map-private.hh
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-ot-math.cc
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-ot-shape-complex-arabic.cc
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-ot-shape-complex-indic-table.cc
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-ot-shape-complex-indic.cc
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-ot-shape-complex-myanmar-machine.hh
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-ot-shape-complex-private.hh
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-ot-shape-normalize.cc
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-ot-shape.cc
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-ot-var-hvar-table.hh
[add] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-ot-var-mvar-table.hh
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-ot-var.cc
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-shape-plan.cc
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-shaper-private.hh
[modify] https://crrev.com/d90b34b2c01631495508bd595a17dbe60fe061c6/third_party/harfbuzz-ng/src/hb-version.h

Thank you Sir!

ClusterFuzz has detected this issue as fixed in range 468788:468811.

Detailed report: https://clusterfuzz.com/testcase?key=6142466903506944

Fuzzer: libfuzzer_harfbuzz_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  OT::RangeRecord::cmp
  int OT::SortedArrayOf<OT::RangeRecord, OT::IntType<unsigned short, 2u> >::bsearc
  OT::CoverageFormat2::get_coverage
  
Sanitizer: memory (MSAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=423366:423427
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=468788:468811

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6142466903506944


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

https://chromium-review.googlesource.com/c/506849/ : CrOS CL

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/530df87964e0d7ddbfe31fab5ea0c322e475b839

commit 530df87964e0d7ddbfe31fab5ea0c322e475b839
Author: Jungshik Shin <jshin@chromium.org>
Date: Fri May 19 20:57:56 2017

Update Harfbuzz to 1.4.6

A few notable changes since 1.4.2

  - Support for Grantha marks that may be used in Tamil
  - A few sanitizer issues are fixed
  - Adlam is routed through Arabic shaper; fixes joined Adlam rendering
  - Variable font: Implement MVAR table for hb-ot

This will sync CrOS with Chromium on other platforms.

Still using a locally modified version of ebuild because EAPI=6 is not
supported and flag-o-matic eclass is not available.

BUG= chromium:712163 
TEST=emerge-{x86-alex,amd64-generic,daisy} harfbuzz
TEST=cbuildbot chromiumos-sdk
TEST=cbuildbot  amd64-generic-full x86-generic-full arm-generic-full

Change-Id: Ief60023f898e862f10f3a62b0b3975b8c7e8f318
Reviewed-on: https://chromium-review.googlesource.com/506849
Commit-Ready: Jungshik Shin <jshin@chromium.org>
Tested-by: Jungshik Shin <jshin@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[add] https://crrev.com/530df87964e0d7ddbfe31fab5ea0c322e475b839/media-libs/harfbuzz/harfbuzz-1.4.6-r1.ebuild
[delete] https://crrev.com/58541f1ab47194df544da0e210dfdebc781ea7bb/media-libs/harfbuzz/harfbuzz-1.4.2-r1.ebuild
[rename] https://crrev.com/530df87964e0d7ddbfe31fab5ea0c322e475b839/media-libs/harfbuzz/harfbuzz-1.4.6.ebuild
[modify] https://crrev.com/530df87964e0d7ddbfe31fab5ea0c322e475b839/media-libs/harfbuzz/Manifest

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot