New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 785803 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Closed: Nov 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug-Security



Sign in to add a comment

Use-of-uninitialized-value in sk_store_a8

Project Member Reported by ClusterFuzz, Nov 16 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5838339717726208

Fuzzer: inferno_twister
Job Type: linux_msan_chrome
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  sk_store_a8
  sk_start_pipeline
  SkScan::FillIRect
  
Sanitizer: memory (MSAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=linux_msan_chrome&range=503435:503455

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5838339717726208

Additional requirements: Requires HTTP

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 16 2017

Cc: w...@gnu.org apodt...@gmail.com
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Swap `ALLOC_MULT' arguments (#51833). by apodtele@gmail.com - https://chromium.googlesource.com/chromium/src/third_party/freetype2/+/f0898b9259d4b3b99a1e720924683730dd36d3db

[base] Don't zero out allocated memory twice (#51816). by wl@gnu.org - https://chromium.googlesource.com/chromium/src/third_party/freetype2/+/bd28952e23bcd268a623ea5202e1cde4a92defe4

If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 2 by sheriffbot@chromium.org, Nov 16 2017

Labels: M-63
Project Member

Comment 3 by sheriffbot@chromium.org, Nov 16 2017

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 4 by sheriffbot@chromium.org, Nov 16 2017

Labels: Pri-1

Comment 5 by mmoroz@chromium.org, Nov 16 2017

Components: Internals>Skia
Owner: hcm@chromium.org
Status: Assigned (was: Untriaged)

Comment 6 by gov...@chromium.org, Nov 16 2017

Cc: awhalley@chromium.org
+awhalley@ (Security TPM)

M63 Stable promotion is coming VERY soon. Your bug is labelled as Stable ReleaseBlock, pls make sure to land the fix and request a merge  into the release branch ASAP. Thank you.

Comment 7 by hcm@chromium.org, Nov 16 2017

Cc: hcm@chromium.org
Owner: mtklein@chromium.org
Cc: mtklein@chromium.org
Owner: bunge...@chromium.org
Given the stack in Skia, this does look plausibly like a change in FreeType could cause this MSAN error.  We're copying a bitmap from FreeType into a glyph cache, and that round() (float -> int) operation at the top of the stack is what MSAN counts as "use".  The data that's being "used" there is the bitmap from FreeType.

Looks like we picked this up with that FreeType roll.
Labels: -Pri-1 -ReleaseBlock-Stable Pri-2
Given that the uninitialized data is rooted in the font, I don't think we're risking any user data or going to cause any trouble beyond drawing wrong if Skia works with this data.  I don't think we need to block Stable on this.
Project Member

Comment 10 by sheriffbot@chromium.org, Nov 17 2017

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: -ReleaseBlock-Stable M-64
Project Member

Comment 12 by sheriffbot@chromium.org, Nov 18 2017

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 13 by apodt...@gmail.com, Nov 18 2017

Cc: wl@gnu.org
Labels: -ReleaseBlock-Stable
Removing "RBS" per comments #9 & #11.

awhalley@, sheriffbot keeps adding "RBS" for M63. Is there any way we can stop this?
Project Member

Comment 15 by sheriffbot@chromium.org, Nov 20 2017

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: -ReleaseBlock-Stable -M-63
Project Member

Comment 17 by sheriffbot@chromium.org, Nov 21 2017

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 18 by hcm@google.com, Nov 21 2017

Labels: -ReleaseBlock-Stable
Project Member

Comment 19 by sheriffbot@chromium.org, Nov 22 2017

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: -Security_Severity-Medium -Security_Impact-Beta -ReleaseBlock-Stable Security_Impact-Head Security_Severity-Low
Maybe we need to tweak the Security_* labels too?

Comment 21 by apodt...@gmail.com, Nov 27 2017

You need to CC correct people. Werner Lemberg does not even have access to this bug report. Fix this before bot-spaming.  
Project Member

Comment 22 by ClusterFuzz, Nov 30 2017

Status: WontFix (was: Assigned)
ClusterFuzz testcase 5838339717726208 is flaky and no longer crashes, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 23 by sheriffbot@chromium.org, Mar 9 2018

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment