New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 764837 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Sep 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Integer-overflow in blink::Canvas2DLayerBridge::DidDraw

Project Member Reported by ClusterFuzz, Sep 13 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6185550771126272

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  blink::Canvas2DLayerBridge::DidDraw
  blink::ImageBufferSurface::Clear
  blink::Canvas2DLayerBridge::Init
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=500168:500208

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6185550771126272

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Cc: msrchandra@chromium.org kkaluri@chromium.org
Components: Internals>GPU>Canvas2D
Labels: -Pri-2 M-63 Test-Predator-Wrong-CLs Pri-1
Owner: xidac...@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using Code Search for the file, "Canvas2DLayerBridge.cpp" assigning to the concern owner who might be related or worked on similar file.

Suspected CL: https://chromium.googlesource.com/chromium/src/+/c6aa998b1ea6143d82c9eb5e94845645f0c964e4

xidachen@ -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Components: -Internals>GPU>Canvas2D Blink>Canvas
Project Member

Comment 3 by bugdroid1@chromium.org, Sep 14 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0a4f16b07a7d32bbfb21b390449a3a8a325831be

commit 0a4f16b07a7d32bbfb21b390449a3a8a325831be
Author: Xida Chen <xidachen@chromium.org>
Date: Thu Sep 14 23:23:15 2017

Fix an integer-overflow in Canvas2DLayerBridge

There is a member variable recording_pixel_count_ in this class, when
it is used, there is potentially an integer overflow. This CL uses the
CheckedNumeric to address the problem.

Bug:  764837 
Change-Id: Ib4114e0f4c100c3a7c2eb694f5079ebb26bb37e5
Reviewed-on: https://chromium-review.googlesource.com/667356
Reviewed-by: Justin Novosad <junov@chromium.org>
Commit-Queue: Xida Chen <xidachen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#502094}
[add] https://crrev.com/0a4f16b07a7d32bbfb21b390449a3a8a325831be/third_party/WebKit/LayoutTests/fast/canvas/canvas-layerBridgeCrashTest.html
[modify] https://crrev.com/0a4f16b07a7d32bbfb21b390449a3a8a325831be/third_party/WebKit/Source/platform/graphics/Canvas2DLayerBridge.cpp
[modify] https://crrev.com/0a4f16b07a7d32bbfb21b390449a3a8a325831be/third_party/WebKit/Source/platform/graphics/Canvas2DLayerBridge.h

Status: Fixed (was: Assigned)
Project Member

Comment 5 by ClusterFuzz, Sep 15 2017

ClusterFuzz has detected this issue as fixed in range 502053:502108.

Detailed report: https://clusterfuzz.com/testcase?key=6185550771126272

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  blink::Canvas2DLayerBridge::DidDraw
  blink::ImageBufferSurface::Clear
  blink::Canvas2DLayerBridge::Init
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=500168:500208
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=502053:502108

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6185550771126272

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Sep 15 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 6185550771126272 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment