New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 772684 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Oct 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security



Sign in to add a comment

Crash in _sk_table_r_sse2

Project Member Reported by ClusterFuzz, Oct 8 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4863270011011072

Fuzzer: libFuzzer_skia_color_space_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x61900005047c
Crash State:
  _sk_table_r_sse2
  SkRasterPipeline::run
  SkColorSpaceXform_XYZ::onApply
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=507294:507299

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4863270011011072

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Oct 8 2017

Components: Tools>Stability>ClusterFuzz
Labels: Test-Predator-AutoComponents
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by sheriffbot@chromium.org, Oct 8 2017

Labels: M-63
Project Member

Comment 3 by sheriffbot@chromium.org, Oct 8 2017

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 4 by sheriffbot@chromium.org, Oct 8 2017

Labels: Pri-1
Components: -Tools>Stability>ClusterFuzz Internals>Skia
Labels: -Test-Predator-AutoComponents Test-Predator-Wrong-Components
Owner: mtklein@chromium.org
Status: Assigned (was: Untriaged)
Looks like regression from https://chromium.googlesource.com/chromium/src/+/a99f7c30fefee961c9e2251bd64e10b9edeabf1f
Cc: fmalita@chromium.org
Project Member

Comment 7 by bugdroid1@chromium.org, Oct 9 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/3fbfff8d6cbabbb2fa716613a6b45f05893334ea

commit 3fbfff8d6cbabbb2fa716613a6b45f05893334ea
Author: Mike Klein <mtklein@chromium.org>
Date: Mon Oct 09 21:23:21 2017

Manually revert "Switch over to new SkColorSpaceXform pipeline."

This reverts commit a99f7c30fefee961c9e2251bd64e10b9edeabf1f,
but not automatically.  It needs new layout test images to revert.

Bug:  772684 , skia:7114

Original change's description:
> Switch over to new SkColorSpaceXform pipeline.
>
> This switches to the much simplified version that supports
> gamma-encoded floats, and handles sRGB slightly differently.
>
> There should be about ~35 very boring looking layout test diffs.
>
> TBR=fmalita@chromium.org
>
> Bug: skia:7114
> Change-Id: I1d685ca27f38a4ca5b1101ff06049929f4f4b9c4
> Reviewed-on: https://chromium-review.googlesource.com/702955
> Reviewed-by: Mike Klein <mtklein@chromium.org>
> Commit-Queue: Mike Klein <mtklein@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#507295}

TBR=fmalita@chromium.org,brianosman@google.com,mtklein@chromium.org

Change-Id: I1bc4dca74d64c2bbd65eadab40c97c6afca63778
Reviewed-on: https://chromium-review.googlesource.com/706929
Commit-Queue: Mike Klein <mtklein@chromium.org>
Reviewed-by: Florin Malita <fmalita@chromium.org>
Reviewed-by: Mike Klein <mtklein@chromium.org>
Cr-Commit-Position: refs/heads/master@{#507490}
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/skia/config/SkUserConfig.h
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/linux/svg/as-border-image/svg-as-border-image-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/linux/virtual/exotic-color-space/images/12-55-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/linux/virtual/exotic-color-space/images/182-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/linux/virtual/exotic-color-space/images/2-dht-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/linux/virtual/exotic-color-space/images/23-55-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/linux/virtual/exotic-color-space/images/55-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/linux/virtual/exotic-color-space/images/alt-text-wrapping-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/linux/virtual/exotic-color-space/images/color-profile-munsell-srgb-to-srgb-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/linux/virtual/exotic-color-space/images/exif-orientation-css-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/linux/virtual/exotic-color-space/images/exif-orientation-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/linux/virtual/exotic-color-space/images/exif-orientation-image-document-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/linux/virtual/exotic-color-space/images/image-map-anchor-children-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/linux/virtual/exotic-color-space/images/imagemap-focus-ring-zero-outline-width-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/linux/virtual/exotic-color-space/images/jpeg-yuv-image-decoding-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/linux/virtual/exotic-color-space/images/rendering-broken-0px-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/linux/virtual/exotic-color-space/images/rendering-broken-0px-images-quirk-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/linux/virtual/exotic-color-space/images/rendering-broken-10px-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/linux/virtual/exotic-color-space/images/rendering-broken-16px-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/linux/virtual/exotic-color-space/images/rendering-broken-1px-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/linux/virtual/exotic-color-space/images/rendering-broken-block-flow-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/linux/virtual/exotic-color-space/images/rendering-broken-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.10/virtual/exotic-color-space/images/12-55-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.10/virtual/exotic-color-space/images/182-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.10/virtual/exotic-color-space/images/2-dht-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.10/virtual/exotic-color-space/images/23-55-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.10/virtual/exotic-color-space/images/55-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.10/virtual/exotic-color-space/images/color-profile-munsell-srgb-to-srgb-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.10/virtual/exotic-color-space/images/jpeg-yuv-image-decoding-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.11/virtual/exotic-color-space/images/12-55-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.11/virtual/exotic-color-space/images/182-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.11/virtual/exotic-color-space/images/2-dht-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.11/virtual/exotic-color-space/images/23-55-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.11/virtual/exotic-color-space/images/55-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.9/virtual/exotic-color-space/images/12-55-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.9/virtual/exotic-color-space/images/182-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.9/virtual/exotic-color-space/images/2-dht-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.9/virtual/exotic-color-space/images/23-55-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.9/virtual/exotic-color-space/images/55-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.9/virtual/exotic-color-space/images/rendering-broken-0px-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.9/virtual/exotic-color-space/images/rendering-broken-0px-images-quirk-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.9/virtual/exotic-color-space/images/rendering-broken-10px-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.9/virtual/exotic-color-space/images/rendering-broken-16px-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.9/virtual/exotic-color-space/images/rendering-broken-1px-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.9/virtual/exotic-color-space/images/rendering-broken-block-flow-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-mac10.9/virtual/exotic-color-space/images/rendering-broken-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-retina/virtual/exotic-color-space/images/12-55-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-retina/virtual/exotic-color-space/images/182-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-retina/virtual/exotic-color-space/images/2-dht-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-retina/virtual/exotic-color-space/images/23-55-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac-retina/virtual/exotic-color-space/images/55-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/fast/media/mq-color-gamut-picture-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/12-55-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/182-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/2-comp-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/2-dht-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/23-55-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/55-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/alt-text-wrapping-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/color-profile-border-image-source-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/color-profile-image-profile-match-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/color-profile-munsell-srgb-to-srgb-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/exif-orientation-css-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/exif-orientation-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/exif-orientation-height-image-document-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/exif-orientation-image-document-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/icon-decoding-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/image-in-map-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/image-map-anchor-children-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/imagemap-focus-ring-zero-outline-width-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/jpeg-yuv-image-decoding-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/jpeg-yuv-progressive-image-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/motion-jpeg-single-frame-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/png-suite/test-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/rendering-broken-0px-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/rendering-broken-0px-images-quirk-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/rendering-broken-10px-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/rendering-broken-16px-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/rendering-broken-1px-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/rendering-broken-block-flow-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/rendering-broken-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/rgb-jpeg-with-adobe-marker-only-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/rgb-png-with-cmyk-color-profile-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/ycbcr-with-cmyk-color-profile-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/fast/media/mq-color-gamut-picture-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/svg/as-border-image/svg-as-border-image-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/12-55-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/182-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/2-comp-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/2-dht-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/23-55-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/55-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/alt-text-wrapping-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/color-profile-border-image-source-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/color-profile-image-profile-match-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/color-profile-munsell-srgb-to-srgb-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/exif-orientation-css-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/exif-orientation-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/exif-orientation-height-image-document-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/exif-orientation-image-document-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/icon-decoding-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/image-in-map-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/image-map-anchor-children-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/imagemap-focus-ring-zero-outline-width-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/jpeg-yuv-image-decoding-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/jpeg-yuv-progressive-image-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/motion-jpeg-single-frame-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/png-suite/test-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/rendering-broken-0px-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/rendering-broken-0px-images-quirk-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/rendering-broken-10px-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/rendering-broken-16px-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/rendering-broken-1px-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/rendering-broken-block-flow-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/rendering-broken-images-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/rgb-jpeg-with-adobe-marker-only-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/rgb-png-with-cmyk-color-profile-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/ycbcr-with-cmyk-color-profile-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/virtual/exotic-color-space/images/embed-image-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/virtual/exotic-color-space/images/gif-short-app-extension-string-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/virtual/exotic-color-space/images/gray-scale-jpeg-with-color-profile-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/virtual/exotic-color-space/images/gray-scale-png-with-color-profile-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/virtual/exotic-color-space/images/object-image-expected.png
[modify] https://crrev.com/3fbfff8d6cbabbb2fa716613a6b45f05893334ea/third_party/WebKit/LayoutTests/virtual/exotic-color-space/images/png-color-profile-ignore-gamma-expected.png

Project Member

Comment 8 by ClusterFuzz, Oct 10 2017

ClusterFuzz has detected this issue as fixed in range 507483:507508.

Detailed report: https://clusterfuzz.com/testcase?key=4863270011011072

Fuzzer: libFuzzer_skia_color_space_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x61900005047c
Crash State:
  _sk_table_r_sse2
  SkRasterPipeline::run
  SkColorSpaceXform_XYZ::onApply
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=507294:507299
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=507483:507508

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4863270011011072

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Oct 10 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 4863270011011072 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 10 by sheriffbot@chromium.org, Oct 10 2017

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 11 by bugdroid1@chromium.org, Oct 10 2017

The following revision refers to this bug:
  https://skia.googlesource.com/skia/+/24f0a354ac618c17a71e4dac80dd0ad370ed14eb

commit 24f0a354ac618c17a71e4dac80dd0ad370ed14eb
Author: Mike Klein <mtklein@chromium.org>
Date: Tue Oct 10 16:31:25 2017

SkColorSpaceXform: clamp before table lookups

The fuzzer has built a single test case that causes out-of-bounds
reads on both the src and dst tables.  I'm glad we have it.

Next follow ups may include:
    - have byte_tables_rgb do its own clamping
    - replace table_{r,g,b} here with a single stage analogous
      to byte_tables_rgb that looks up the three float tables
      safely
    - maybe replace byte_tables_rgb with that.  I'm not really
      sure why src->XYZ tables are floats but XYZ->dst are bytes.

I'm going to try some of these out before attempting to reland
in Chrome.  As usual, rebaselining Blink makes things a pain.

Bug:  chromium:772684 , skia:7114
Change-Id: Id8759e766330e1c7689c0847bf2cd35d422ebbcd
Reviewed-on: https://skia-review.googlesource.com/57760
Reviewed-by: Brian Osman <brianosman@google.com>
Commit-Queue: Mike Klein <mtklein@chromium.org>

[modify] https://crrev.com/24f0a354ac618c17a71e4dac80dd0ad370ed14eb/src/core/SkColorSpaceXform.cpp

Cc: kateso...@chromium.org
Both regressed and fixed in M63, removing ReleaseBlock-Stable
Labels: -ReleaseBlock-Stable
Project Member

Comment 15 by sheriffbot@chromium.org, Jan 16 2018

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 16 by sheriffbot@chromium.org, Mar 27 2018

Labels: -Security_Impact-Head -M-63 M-65 Security_Impact-Stable

Sign in to add a comment