pobfuzz: SkRRect::computeType vs isValid inconsistency |
|||||
Issue descriptionSkRRect::readFromMemory can assert on bad rrects. computeType always asserts isValid, but I think this is incorrect to do. For example, if fRect is empty, then it says the type is empty, but isValid then checks all the radii. It seems like maybe readFromMemory should check (but not assert) on isValid and return 0 if it's not.
,
Nov 20 2017
,
Nov 21 2017
Detailed report: https://clusterfuzz.com/testcase?key=6211117075660800 Fuzzer: libFuzzer_paint_op_buffer_fuzzer Job Type: libfuzzer_chrome_asan_debug Crash Type: Abrt Crash Address: 0x03e900004892 Crash State: sk_abort_no_print SkRRect::computeType SkRRect::computeType Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=503567:503617 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6211117075660800 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Nov 21 2017
Yeah, I'd generalize it to never deserializing a rrect with negative a negative radius.
,
Nov 27 2017
,
Nov 28 2017
ClusterFuzz has detected this issue as fixed in range 519302:519318. Detailed report: https://clusterfuzz.com/testcase?key=6211117075660800 Fuzzer: libFuzzer_paint_op_buffer_fuzzer Job Type: libfuzzer_chrome_asan_debug Crash Type: Abrt Crash Address: 0x03e900004892 Crash State: sk_abort_no_print SkRRect::computeType SkRRect::computeType Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=503567:503617 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=519302:519318 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6211117075660800 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 28 2017
ClusterFuzz testcase 6211117075660800 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, Nov 20 2017