New issue
Advanced search Search tips

Issue 734531 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Closed: Jul 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug



Sign in to add a comment

Crash in blink::FontCache::CrashWithFontInfo

Project Member Reported by ClusterFuzz, Jun 19 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4905298644172800

Fuzzer: inferno_twister
Job Type: windows_asan_chrome_no_sandbox
Platform Id: windows

Crash Type: UNKNOWN READ
Crash Address: 0x833f3200
Crash State:
  blink::FontCache::CrashWithFontInfo
  blink::FontFallbackIterator::Next
  blink::FontFallbackIterator::Next
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_no_sandbox&range=480259:480271

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4905298644172800


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Project Member

Comment 1 by sheriffbot@chromium.org, Jun 19 2017

Labels: M-61
Project Member

Comment 2 by sheriffbot@chromium.org, Jun 19 2017

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 3 by sheriffbot@chromium.org, Jun 19 2017

Labels: Pri-1

Comment 4 by est...@chromium.org, Jun 19 2017

Components: Blink>Fonts
Owner: kojii@chromium.org
Status: Assigned (was: Untriaged)
kojii, PTAL?
Labels: -Type-Bug-Security -Restrict-View-SecurityTeam -Security_Severity-Medium -Security_Impact-Head Type-Bug
CHECK failure is not a security bug, we fixed the parsing logic on clusterfuzz side, sorry for noise.

Comment 6 by kojii@chromium.org, Jun 26 2017

Labels: -ReleaseBlock-Stable
Removing RBS because of #5 and because this is non-reproducible. I'll see it a while more if this can reproduce.

This is an intentional crash to track down issue 561873.

Comment 7 by kojii@chromium.org, Jul 11 2017

Labels: -Pri-1 Pri-2

Comment 8 by kojii@chromium.org, Jul 17 2017

Status: WontFix (was: Assigned)
WontFix since we could not reproduce it after a while.

Sign in to add a comment