pobfuzz: assert on bogus SkMatrix type field |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5787848946221056 Fuzzer: libFuzzer_paint_op_buffer_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Abrt Crash Address: 0x03e900000707 Crash State: sk_abort_no_print SkMatrix::setTypeMask SkMatrix::invertNonIdentity Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=496919:496954 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5787848946221056 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Sep 12 2017
We probably need to just set this field as unknown when serializing SkMatrix.
,
Sep 14 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/3af8e2d75b4b325f751ab8bc7624799b9f48835e commit 3af8e2d75b4b325f751ab8bc7624799b9f48835e Author: Adrienne Walker <enne@chromium.org> Date: Thu Sep 14 22:53:56 2017 cc: Invalidate SkMatrix type after deserializing This is not a safe field to serialize as malicious clients can lie about what kind of matrix this is, which causes Skia asserts. Fix this by clearing this field after serializing. Bug: 763668 Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel Change-Id: I7f1ad8c7e1a556af6beed205406693b69bd2b622 Reviewed-on: https://chromium-review.googlesource.com/667796 Reviewed-by: Vladimir Levin <vmpstr@chromium.org> Commit-Queue: enne <enne@chromium.org> Cr-Commit-Position: refs/heads/master@{#502071} [modify] https://crrev.com/3af8e2d75b4b325f751ab8bc7624799b9f48835e/cc/paint/paint_op_buffer.cc [modify] https://crrev.com/3af8e2d75b4b325f751ab8bc7624799b9f48835e/cc/paint/paint_op_buffer_unittest.cc
,
Sep 15 2017
ClusterFuzz has detected this issue as fixed in range 502042:502118. Detailed report: https://clusterfuzz.com/testcase?key=5787848946221056 Fuzzer: libFuzzer_paint_op_buffer_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Abrt Crash Address: 0x03e900000707 Crash State: sk_abort_no_print SkMatrix::setTypeMask SkMatrix::invertNonIdentity Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=496919:496954 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=502042:502118 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5787848946221056 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Sep 15 2017
ClusterFuzz testcase 5787848946221056 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||
►
Sign in to add a comment |
|||
Comment 1 by msrchandra@chromium.org
, Sep 11 2017Labels: Test-Predator-Wrong-CLs M-63