Validate deserialization of DrawArcOp |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5164586063101952 Fuzzer: libFuzzer_paint_op_buffer_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Abrt Crash Address: 0x03e900005f44 Crash State: sk_abort_no_print SkConic::BuildUnitArc build_arc_conics Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=491830:491916 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5164586063101952 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Aug 7 2017
Assert: https://skia.googlesource.com/skia/+/155e94297a466a4e4c4c3e353359de18ab9720ab/src/core/SkGeometry.cpp#1419 Looks like there's some validation that's needed on DrawArcOp, but there's not any easy method exposed at the moment.
,
Aug 16 2017
,
Aug 21 2017
,
Aug 22 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/371d628e5cad40221a71f7ee3a5eddf34adf9680 commit 371d628e5cad40221a71f7ee3a5eddf34adf9680 Author: Adrienne Walker <enne@chromium.org> Date: Tue Aug 22 23:25:43 2017 Validate DrawArcOp inputs Skip nans because they cause Skia asserts. Bug: 752757 Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel Change-Id: I8ac1ac10c785dad5eb74dd33107f1febb7e361c4 Reviewed-on: https://chromium-review.googlesource.com/627394 Commit-Queue: enne <enne@chromium.org> Reviewed-by: Vladimir Levin <vmpstr@chromium.org> Cr-Commit-Position: refs/heads/master@{#496503} [modify] https://crrev.com/371d628e5cad40221a71f7ee3a5eddf34adf9680/cc/paint/paint_op_buffer.h
,
Aug 23 2017
ClusterFuzz has detected this issue as fixed in range 496444:496518. Detailed report: https://clusterfuzz.com/testcase?key=5164586063101952 Fuzzer: libFuzzer_paint_op_buffer_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Abrt Crash Address: 0x03e900005f44 Crash State: sk_abort_no_print SkConic::BuildUnitArc build_arc_conics Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=491830:491916 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=496444:496518 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5164586063101952 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Aug 23 2017
ClusterFuzz testcase 5164586063101952 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Aug 25 2017
Issue 754430 has been merged into this issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by msrchandra@chromium.org
, Aug 7 2017Labels: M-62 Test-Predator-Wrong