This is another bug found by my filter_proto_fuzzer
Although it is only a NULL deref, fixing it would be really helpful, since the fuzzer's ability to find more important bugs is hampered by this bug, because the fuzzer runs into this bug very frequently.

REPRODUCTION CASE

1. Build filter_fuzz_stub with these arguments:
enable_nacl = false
ffmpeg_branding = "ChromeOS"
pdf_enable_xfa = true
proprietary_codecs = true
use_goma = true
is_debug = false
is_asan = true
optimize_for_fuzzing=true

2. Run it on the attached input (skia-null-read)

I've found that a crash will happen if filter_fuzz_stub is built with ASAN, MSAN or no sanitizers at all.

Here is the stack trace from running an ASAN instrumented filter_fuzz_stub on skia-null-read:

[1121/231011.537621:INFO:filter_fuzz_stub.cc(61)] Test case: skia-null-read
[1121/231011.593922:INFO:filter_fuzz_stub.cc(38)] Valid stream detected.
AddressSanitizer:DEADLYSIGNAL
=================================================================
==185673==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000a377ed bp 0x7ffc0df57c70 sp 0x7ffc0df57c60 T0)
==185673==The signal is caused by a READ memory access.
==185673==Hint: address points to the zero page.
    #0 0xa377ec in SkColorSpace::gammaIsLinear() const third_party/skia/src/core/SkColorSpace.cpp:250:26
    #1 0xdf2824 in SkToSRGBColorFilter::onAppendStages(SkRasterPipeline*, SkColorSpace*, SkArenaAlloc*, bool) const third_party/skia/src/effects/SkToSRGBColorFilter.cpp:27:25
    #2 0xb85b05 in SkRasterPipelineBlitter::Create(SkPixmap const&, SkPaint const&, SkArenaAlloc*, SkRasterPipeline const&, SkShaderBase::Context*, bool, bool) third_party/skia/src/core/SkRasterPipelineBlitter.cpp:167:22
    #3 0xb8534d in SkCreateRasterPipelineBlitter(SkPixmap const&, SkPaint const&, SkMatrix const&, SkArenaAlloc*) third_party/skia/src/core/SkRasterPipelineBlitter.cpp:101:16
    #4 0xa927d8 in SkBlitter::Choose(SkPixmap const&, SkMatrix const&, SkPaint const&, SkArenaAlloc*, bool) third_party/skia/src/core/SkBlitter.cpp:1001:24
    #5 0xa62bb1 in SkAutoBlitterChoose::SkAutoBlitterChoose(SkPixmap const&, SkMatrix const&, SkPaint const&, bool) third_party/skia/src/core/SkAutoBlitterChoose.h:25:20
    #6 0xa66d20 in SkDraw::drawRect(SkRect const&, SkPaint const&, SkMatrix const*, SkRect const*) const third_party/skia/src/core/SkDraw.cpp:802:29
    #7 0xa2b527 in SkBitmapDevice::drawRect(SkRect const&, SkPaint const&) third_party/skia/src/core/SkBitmapDevice.cpp:195:18
    #8 0xa1b6d5 in SkCanvas::onDrawRect(SkRect const&, SkPaint const&) third_party/skia/src/core/SkCanvas.cpp:2029:27
    #9 0xa15dba in SkCanvas::drawRect(SkRect const&, SkPaint const&) third_party/skia/src/core/SkCanvas.cpp:1710:11
    #10 0xde0385 in SkPaintImageFilter::onFilterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/effects/SkPaintImageFilter.cpp:66:13
    #11 0xab6e94 in SkImageFilter::filterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/core/SkImageFilter.cpp:213:40
    #12 0xa2d80e in SkBitmapDevice::drawSpecial(SkSpecialImage*, int, int, SkPaint const&, SkImage*, SkMatrix const&) third_party/skia/src/core/SkBitmapDevice.cpp:421:33
    #13 0xa10115 in SkCanvas::internalDrawDevice(SkBaseDevice*, int, int, SkPaint const*, SkImage*, SkMatrix const&) third_party/skia/src/core/SkCanvas.cpp:1313:25
    #14 0xa0c050 in SkCanvas::internalRestore() third_party/skia/src/core/SkCanvas.cpp:1201:19
    #15 0xa1184c in AutoDrawLooper::~AutoDrawLooper() third_party/skia/src/core/SkCanvas.cpp:495:22
    #16 0xa1f12e in SkCanvas::onDrawBitmap(SkBitmap const&, float, float, SkPaint const*) third_party/skia/src/core/SkCanvas.cpp:2308:1
    #17 0xa189a8 in SkCanvas::drawBitmap(SkBitmap const&, float, float, SkPaint const*) third_party/skia/src/core/SkCanvas.cpp:1831:11
    #18 0x75c40f in (anonymous namespace)::RunTestCase(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >&, SkBitmap&, SkCanvas*) skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:48:13
    #19 0x75afcd in (anonymous namespace)::ReadAndRunTestCase(char const*, SkBitmap&, SkCanvas*) skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:67:3
    #20 0x75aac6 in main skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:87:10
    #21 0x7fd9b5a7df44 in __libc_start_main /build/eglibc-SvCtMH/eglibc-2.19/csu/libc-start.c:287

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV third_party/skia/src/core/SkColorSpace.cpp:250:26 in SkColorSpace::gammaIsLinear() const
==185673==ABORTING



 

Deleted: skia-null-read 280 bytes

skia-null-read 280 bytes View Download