New issue
Advanced search Search tips

Issue 794523 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 793285
Owner:
Closed: Dec 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac , Fuchsia
Pri: 1
Type: Bug-Security



Sign in to add a comment

Use-of-uninitialized-value in sk_unpremul

Project Member Reported by ClusterFuzz, Dec 13 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4649811436634112

Fuzzer: attekett_surku_fuzzer
Job Type: linux_msan_chrome
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  sk_unpremul
  sk_start_pipeline
  SkScan::FillIRect
  
Sanitizer: memory (MSAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=linux_msan_chrome&range=519805:519843

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4649811436634112

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Dec 13 2017

Components: Internals>Skia
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by sheriffbot@chromium.org, Dec 13 2017

Labels: M-64
Project Member

Comment 3 by sheriffbot@chromium.org, Dec 13 2017

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 4 by sheriffbot@chromium.org, Dec 13 2017

Labels: Pri-1
Project Member

Comment 5 by sheriffbot@chromium.org, Dec 14 2017

Labels: -Security_Impact-Head Security_Impact-Beta

Comment 6 by cthomp@chromium.org, Dec 14 2017

Labels: OS-Android OS-Chrome OS-Fuchsia OS-Mac OS-Windows
@herb: Could you help find an owner for this? Thanks.

Comment 7 by cthomp@chromium.org, Dec 15 2017

Cc: herb@google.com
(Looks like I missed adding the CC, sorry. Retrying.)

@herb: Could you help find an owner for this? Thanks.

Comment 8 by herb@google.com, Dec 15 2017

Access denied when try to look at the detailed report:

You (email=herb@google.com) are not authorized to access this page!

Please contact clusterfuzz-dev [at] chromium [dot] org. If you are trying to access the testcase for a bug, make sure that you are marked as Owner.

Comment 9 by cthomp@chromium.org, Dec 15 2017

Cc: -herb@google.com
Owner: herb@google.com
Switching you to owner for now. That should let you access the report, but let me know if it doesn't work.

Comment 10 by herb@google.com, Dec 15 2017

Still access denied. :-(

In addition, tried logging out and logging back in. Try on both linux and mac.
Cc: mtklein@chromium.org
This looks like it may be a dupe of  crbug.com/791317 . Waiting for clusterfuzz to see if it's already verified as fixed or not.
Clusterfuzz says this is fixed already, but since it doesn't appear to have de-duped them I'd like to wait for confirmation before closing.
Project Member

Comment 14 by sheriffbot@chromium.org, Dec 16 2017

Status: Assigned (was: Untriaged)
Cc: herb@google.com
Owner: mtklein@chromium.org
Hey, I cannot see the details here.

You (email=mtklein@chromium.org) are not authorized to access this page!

Please contact clusterfuzz-dev [at] chromium [dot] org. If you are trying to access the testcase for a bug, make sure that you are marked as Owner.

Switch account
Logout
Status: WontFix (was: Assigned)
Can't do much without that detailed report.  Happy to investigate if we get that working.
Status: Assigned (was: WontFix)
Project Member

Comment 19 by ClusterFuzz, Dec 18 2017

Detailed report: https://clusterfuzz.com/testcase?key=4649811436634112

Fuzzer: attekett_surku_fuzzer
Job Type: linux_msan_chrome
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  sk_unpremul
  sk_start_pipeline
  SkScan::FillIRect
  
Sanitizer: memory (MSAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=linux_msan_chrome&range=519805:519843
Fixed: https://clusterfuzz.com/revisions?job=linux_msan_chrome&range=523623:523651

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4649811436634112

See https://github.com/google/clusterfuzz-tools for more information.
Please try again now!
Mergedinto: 793285
Status: Duplicate (was: Assigned)
This was fixed by https://skia-review.googlesource.com/c/skia/+/83562.
Project Member

Comment 22 by sheriffbot@chromium.org, Dec 19 2017

Labels: -reward-topanel reward-ineligible
Project Member

Comment 23 by sheriffbot@chromium.org, Mar 28 2018

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment