New issue
Advanced search Search tips

Issue 726755 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: May 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 2
Type: Bug-Security



Sign in to add a comment

Heap-use-after-free in CFX_BitmapComposer::~CFX_BitmapComposer

Project Member Reported by ClusterFuzz, May 26 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5481432435916800

Fuzzer: ifratric_acrojs
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: Heap-use-after-free READ 1
Crash Address: 0x6040000bade0
Crash State:
  CFX_BitmapComposer::~CFX_BitmapComposer
  CFX_ImageRenderer::~CFX_ImageRenderer
  FPDF_RenderPage_Close
  
Sanitizer: address (ASAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=474973:474978

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5481432435916800


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Project Member

Comment 1 by ClusterFuzz, May 26 2017

Labels: OS-Linux

Comment 2 by tsepez@chromium.org, May 26 2017

Cc: thestig@chromium.org dsinclair@chromium.org
Components: Internals>Plugins>PDF
Owner: tsepez@chromium.org
Status: Assigned (was: Untriaged)
Probe => Low severity.
Project Member

Comment 3 by sheriffbot@chromium.org, May 27 2017

Labels: M-60
Project Member

Comment 4 by sheriffbot@chromium.org, May 27 2017

Labels: ReleaseBlock-Beta
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 5 by sheriffbot@chromium.org, May 27 2017

Labels: Pri-1
Labels: -ReleaseBlock-Beta -Security_Severity-High Security_Severity-Low
Project Member

Comment 7 by sheriffbot@chromium.org, May 28 2017

Labels: -Pri-1 Pri-2
Status: Fixed (was: Assigned)
I believe fixed, we'll let CF confirm.
Cc: tsepez@chromium.org
 Issue 727037  has been merged into this issue.
 Issue 727105  has been merged into this issue.
Project Member

Comment 13 by ClusterFuzz, May 31 2017

ClusterFuzz has detected this issue as fixed in range 475714:475740.

Detailed report: https://clusterfuzz.com/testcase?key=5481432435916800

Fuzzer: ifratric_acrojs
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: Heap-use-after-free READ 1
Crash Address: 0x6040000bade0
Crash State:
  CFX_BitmapComposer::~CFX_BitmapComposer
  CFX_ImageRenderer::~CFX_ImageRenderer
  FPDF_RenderPage_Close
  
Sanitizer: address (ASAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=474973:474978
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=475714:475740

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5481432435916800


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 14 by sheriffbot@chromium.org, May 31 2017

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 15 by sheriffbot@chromium.org, Sep 6 2017

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment