This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

bungeman, similar to other one.  Can you take a look or re-assign as appropriate?

 Issue 754661  has been merged into this issue.

This is getting hit by two separate fuzzers. Can someone from Skia please take a look at it?

Looks like the inputs for the gradient factory are invalid: passed count > allocated pos storage.

Most likely the problem is outside Skia, I'll take a look.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2f5940ae12c373666ff2ccf74eed847aaa351987

commit 2f5940ae12c373666ff2ccf74eed847aaa351987
Author: Vladimir Levin <vmpstr@chromium.org>
Date: Fri Aug 11 18:01:05 2017

cc/paint: Validate shaders during deserialization.

This patch ensures that we run basic sanity validation on deserialized
shaders.

R=enne@chromium.org

Bug:  754086 ,  753618 
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Icb6448c687488e09efb3b5110cc8bebe37fc7025
Reviewed-on: https://chromium-review.googlesource.com/610938
Commit-Queue: Vladimir Levin <vmpstr@chromium.org>
Reviewed-by: Florin Malita <fmalita@chromium.org>
Reviewed-by: enne <enne@chromium.org>
Cr-Commit-Position: refs/heads/master@{#493805}
[modify] https://crrev.com/2f5940ae12c373666ff2ccf74eed847aaa351987/cc/paint/paint_op_reader.cc
[modify] https://crrev.com/2f5940ae12c373666ff2ccf74eed847aaa351987/cc/paint/paint_shader.cc
[modify] https://crrev.com/2f5940ae12c373666ff2ccf74eed847aaa351987/cc/paint/paint_shader.h

ClusterFuzz has detected this issue as fixed in range 493780:493839.

Detailed report: https://clusterfuzz.com/testcase?key=6569444632690688

Fuzzer: libFuzzer_paint_op_buffer_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Heap-buffer-overflow READ 4
Crash Address: 0x602000000d7c
Crash State:
  SkGradientShaderBase::SkGradientShaderBase
  SkSweepGradient::SkSweepGradient
  sk_sp<SkSweepGradient> sk_make_sp<SkSweepGradient, SkPoint, float const&, float 
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=492381:492438
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=493780:493839

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6569444632690688

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot