Security: use-of-unitialized-value in GetScale (SkUnPeMultiply.h:29) in filter_fuzz_stub |
|||||||||||||||
Issue description
This was found by skia_image_filter_proto_fuzzer (filter_proto_fuzzer) using MSAN.
REPRODUCTION CASE
1. Build filter_fuzz_stub using the following options:
enable_nacl = false
ffmpeg_branding = "ChromeOS"
is_msan = true
pdf_enable_xfa = true
proprietary_codecs = true
use_libfuzzer = true
use_goma = true
is_debug = false
optimize_for_fuzzing = true
2. Run it on the attached input (ffs-getscale):
$ ./out/skmsan/filter_fuzz_stub ffs-premult
[0107/020931.673722:INFO:filter_fuzz_stub.cc(61)] Test case: ffs-premult
[0107/020931.677843:INFO:filter_fuzz_stub.cc(38)] Valid stream detected.
==59124==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0xc5fe04 in GetScale third_party/skia/include/core/SkUnPreMultiply.h:29:16
#1 0xc5fe04 in SkUnPreMultiply::PMColorToColor(unsigned int) third_party/skia/src/core/SkUnPreMultiply.cpp:12
#2 0x13f3fdc in unpremultiply_bitmap third_party/skia/src/effects/SkMatrixConvolutionImageFilter.cpp:263:25
#3 0x13f3fdc in SkMatrixConvolutionImageFilter::onFilterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/effects/SkMatrixConvolutionImageFilter.cpp:348
#4 0xa71d4a in SkImageFilter::filterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/core/SkImageFilter.cpp:213:40
#5 0x114e2bf in SkBitmapDevice::drawSpecial(SkSpecialImage*, int, int, SkPaint const&, SkImage*, SkMatrix const&) third_party/skia/src/core/SkBitmapDevice.cpp:421:33
#6 0x9a05d0 in SkCanvas::internalDrawDevice(SkBaseDevice*, int, int, SkPaint const*, SkImage*, SkMatrix const&) third_party/skia/src/core/SkCanvas.cpp:1313:25
#7 0x998de8 in SkCanvas::internalRestore() third_party/skia/src/core/SkCanvas.cpp:1201:19
#8 0x9c7e5d in ~AutoDrawLooper third_party/skia/src/core/SkCanvas.cpp:495:22
#9 0x9c7e5d in SkCanvas::onDrawBitmap(SkBitmap const&, float, float, SkPaint const*) third_party/skia/src/core/SkCanvas.cpp:2308
#10 0x9b3d6a in SkCanvas::drawBitmap(SkBitmap const&, float, float, SkPaint const*) third_party/skia/src/core/SkCanvas.cpp:1831:11
#11 0x49601e in RunTestCase skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:48:13
#12 0x49601e in ReadAndRunTestCase skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:67
#13 0x49601e in main skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:87
#14 0x7ff9de6d5f44 in __libc_start_main /build/eglibc-SvCtMH/eglibc-2.19/csu/libc-start.c:287
#15 0x4243c9 in _start (/usr/local/google/home/metzman/chromium1/src/out/skmsan/filter_fuzz_stub+0x4243c9)
Uninitialized value was created by a heap allocation
#0 0x449fbd in __interceptor_malloc /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/msan/msan_interceptors.cc:939:3
#1 0x190ce16 in base::UncheckedMalloc(unsigned long, void**) base/process/memory_linux.cc:104:13
#2 0x96d9b2 in sk_malloc_nothrow skia/ext/SkMemory_new_handler.cpp:76:19
#3 0x96d9b2 in sk_malloc_flags(unsigned long, unsigned int) skia/ext/SkMemory_new_handler.cpp:88
#4 0xa84540 in sk_malloc_canfail third_party/skia/include/private/SkMalloc.h:102:12
#5 0xa84540 in MakeUsing third_party/skia/src/core/SkMallocPixelRef.cpp:76
#6 0xa84540 in SkMallocPixelRef::MakeAllocate(SkImageInfo const&, unsigned long) third_party/skia/src/core/SkMallocPixelRef.cpp:86
#7 0x973b68 in SkBitmap::tryAllocPixels(SkImageInfo const&, unsigned long) third_party/skia/src/core/SkBitmap.cpp:254:28
#8 0x13f4e42 in tryAllocPixels third_party/skia/include/core/SkBitmap.h:523:22
#9 0x13f4e42 in SkMatrixConvolutionImageFilter::onFilterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/effects/SkMatrixConvolutionImageFilter.cpp:359
#10 0xa71d4a in SkImageFilter::filterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/core/SkImageFilter.cpp:213:40
#11 0xa7a4b5 in SkImageFilter::filterInput(int, SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/core/SkImageFilter.cpp:512:41
#12 0x13f2bff in SkMatrixConvolutionImageFilter::onFilterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/effects/SkMatrixConvolutionImageFilter.cpp:290:39
#13 0xa71d4a in SkImageFilter::filterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/core/SkImageFilter.cpp:213:40
#14 0x114e2bf in SkBitmapDevice::drawSpecial(SkSpecialImage*, int, int, SkPaint const&, SkImage*, SkMatrix const&) third_party/skia/src/core/SkBitmapDevice.cpp:421:33
#15 0x9a05d0 in SkCanvas::internalDrawDevice(SkBaseDevice*, int, int, SkPaint const*, SkImage*, SkMatrix const&) third_party/skia/src/core/SkCanvas.cpp:1313:25
#16 0x998de8 in SkCanvas::internalRestore() third_party/skia/src/core/SkCanvas.cpp:1201:19
#17 0x9c7e5d in ~AutoDrawLooper third_party/skia/src/core/SkCanvas.cpp:495:22
#18 0x9c7e5d in SkCanvas::onDrawBitmap(SkBitmap const&, float, float, SkPaint const*) third_party/skia/src/core/SkCanvas.cpp:2308
#19 0x9b3d6a in SkCanvas::drawBitmap(SkBitmap const&, float, float, SkPaint const*) third_party/skia/src/core/SkCanvas.cpp:1831:11
#20 0x49601e in RunTestCase skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:48:13
#21 0x49601e in ReadAndRunTestCase skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:67
#22 0x49601e in main skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:87
#23 0x7ff9de6d5f44 in __libc_start_main /build/eglibc-SvCtMH/eglibc-2.19/csu/libc-start.c:287
SUMMARY: MemorySanitizer: use-of-uninitialized-value third_party/skia/include/core/SkUnPreMultiply.h:29:16 in GetScale
Exiting
,
Jan 7 2018
ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://clusterfuzz.com/testcase?key=6439524426317824.
,
Jan 7 2018
ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://clusterfuzz.com/testcase?key=6681008291446784.
,
Jan 8 2018
Detailed report: https://clusterfuzz.com/testcase?key=6681008291446784 Job Type: linux_msan_filter_fuzz_stub Crash Type: Use-of-uninitialized-value Crash Address: Crash State: SkUnPreMultiply::PMColorToColor SkMatrixConvolutionImageFilter::onFilterImage SkImageFilter::filterImage Sanitizer: memory (MSAN) Recommended Security Severity: Medium Regressed: https://clusterfuzz.com/revisions?job=linux_msan_filter_fuzz_stub&range=386914:386987 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6681008291446784 See https://github.com/google/clusterfuzz-tools for more information. A recommended severity was added to this bug. Please change the severity if it is inaccurate.
,
Jan 8 2018
Automatically adding ccs based on suspected regression changelists: Switch SkMatrixConvolutionImageFilter over to new onFilterImage interface by robertphillips@google.com - https://chromium.googlesource.com/skia/+/dada4dd9cf03e42369ca5b38086dba77f01a68e6 If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
,
Jan 8 2018
,
Jan 8 2018
,
Jan 8 2018
,
Jan 8 2018
,
Jan 8 2018
,
Jan 8 2018
,
Jan 22 2018
,
Jan 24 2018
The following revision refers to this bug: https://skia.googlesource.com/skia/+/dc3d7fcbb816c8b06c0ab7e6a0aa333c96c8aeef commit dc3d7fcbb816c8b06c0ab7e6a0aa333c96c8aeef Author: Robert Phillips <robertphillips@google.com> Date: Wed Jan 24 20:13:49 2018 Add check for bad enum in SkMatrixConvolutionImageFilter's CreateProc Bug: chromium:794402 , chromium:799775 Change-Id: Ifbc9714b0095c8f4ca44d444bc48514dc90d7f4d Reviewed-on: https://skia-review.googlesource.com/99203 Commit-Queue: Robert Phillips <robertphillips@google.com> Reviewed-by: Mike Reed <reed@google.com> [modify] https://crrev.com/dc3d7fcbb816c8b06c0ab7e6a0aa333c96c8aeef/src/effects/SkMatrixConvolutionImageFilter.cpp
,
Jan 25 2018
ClusterFuzz has detected this issue as fixed in range 531767:531771. Detailed report: https://clusterfuzz.com/testcase?key=6681008291446784 Job Type: linux_msan_filter_fuzz_stub Crash Type: Use-of-uninitialized-value Crash Address: Crash State: SkUnPreMultiply::PMColorToColor SkMatrixConvolutionImageFilter::onFilterImage SkImageFilter::filterImage Sanitizer: memory (MSAN) Recommended Security Severity: Medium Regressed: https://clusterfuzz.com/revisions?job=linux_msan_filter_fuzz_stub&range=386914:386987 Fixed: https://clusterfuzz.com/revisions?job=linux_msan_filter_fuzz_stub&range=531767:531771 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6681008291446784 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jan 25 2018
ClusterFuzz testcase 6681008291446784 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Feb 8 2018
,
Mar 6 2018
,
Apr 17 2018
,
May 3 2018
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||
►
Sign in to add a comment |
|||||||||||||||
Comment 1 by ClusterFuzz
, Jan 7 2018