New issue
Advanced search Search tips

Issue 795606 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner: ----
Closed: Jan 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Bus in blink::CopyPixels

Project Member Reported by ClusterFuzz, Dec 17 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5041075575324672

Fuzzer: noel-image-surku
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: Bus
Crash Address: 0x7f61c0382000
Crash State:
  blink::CopyPixels
  blink::ImageFrameGenerator::DecodeAndScale
  blink::DecodingImageGenerator::GetPixels
  
Sanitizer: cfi (CFI)

Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=524000:524007

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5041075575324672

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Dec 17 2017

Components: Blink>Paint
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: gyuyoung...@chromium.org kkaluri@chromium.org
Labels: M-65 Test-Predator-Wrong CF-NeedsTriage
Unable to provide possible suspect using Predator, CL and Code Search.

based on the code search for the file "ImageFrameGenerator.cpp" & "DecodingImageGenerator.cpp" on CL: https://chromium.googlesource.com/chromium/src/+/4c58fbeaf0498087c2575f1b1cd17360ccced090
CC'ing the author for further triage.

gyuyoung.kim@  -- Could you please look into this issue and kindly reassign it to concern dev person.

Thank You.
Components: -Blink>Paint Internals>Images>Codecs
Cc: vmp...@chromium.org
This is unrelated to the change in #2.

The image has very large dimensions (as we often see in images produced by fuzzers). Though the screen descriptor specifies a small screen (10 x 9), the first frame is located at (LTRB) (11308, 11308, 11308, 11308), and we expand the image to fit the first frame. So the dimensions of the image are 22,616 x 22,616. The stack trace reflects this, when we see the large malloc (tcmalloc: large alloc 2045935616 bytes).

The line in CopyPixels where we get the Bus error is just copying the already decoded memory (sort of - the ImageDecoder will have zero'ed it after malloc'ing it, but it doesn't look like the image has much to decode, so it should mostly be 0) into the memory provided by to the generator. So that memory must be invalid. I'm not sure where that memory was allocated, but I think it came from discardable memory?
Project Member

Comment 5 by ClusterFuzz, Jan 11 2018

Status: WontFix (was: Untriaged)
ClusterFuzz testcase 5041075575324672 is flaky and no longer crashes, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment