Bus in blink::CopyPixels |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5041075575324672 Fuzzer: noel-image-surku Job Type: linux_cfi_chrome Platform Id: linux Crash Type: Bus Crash Address: 0x7f61c0382000 Crash State: blink::CopyPixels blink::ImageFrameGenerator::DecodeAndScale blink::DecodingImageGenerator::GetPixels Sanitizer: cfi (CFI) Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=524000:524007 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5041075575324672 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Dec 18 2017
Unable to provide possible suspect using Predator, CL and Code Search. based on the code search for the file "ImageFrameGenerator.cpp" & "DecodingImageGenerator.cpp" on CL: https://chromium.googlesource.com/chromium/src/+/4c58fbeaf0498087c2575f1b1cd17360ccced090 CC'ing the author for further triage. gyuyoung.kim@ -- Could you please look into this issue and kindly reassign it to concern dev person. Thank You.
,
Dec 18 2017
,
Dec 20 2017
This is unrelated to the change in #2. The image has very large dimensions (as we often see in images produced by fuzzers). Though the screen descriptor specifies a small screen (10 x 9), the first frame is located at (LTRB) (11308, 11308, 11308, 11308), and we expand the image to fit the first frame. So the dimensions of the image are 22,616 x 22,616. The stack trace reflects this, when we see the large malloc (tcmalloc: large alloc 2045935616 bytes). The line in CopyPixels where we get the Bus error is just copying the already decoded memory (sort of - the ImageDecoder will have zero'ed it after malloc'ing it, but it doesn't look like the image has much to decode, so it should mostly be 0) into the memory provided by to the generator. So that memory must be invalid. I'm not sure where that memory was allocated, but I think it came from discardable memory?
,
Jan 11 2018
ClusterFuzz testcase 5041075575324672 is flaky and no longer crashes, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, Dec 17 2017Labels: Test-Predator-Auto-Components