New issue
Advanced search Search tips

Issue 799775 link

Starred by 1 user

Issue metadata

Status: Verified
Owner: ----
Closed: Jan 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac , Fuchsia
Pri: 1
Type: Bug-Security



Sign in to add a comment

Security: use-of-unitialized-value in GetScale (SkUnPeMultiply.h:29) in filter_fuzz_stub

Project Member Reported by metzman@chromium.org, Jan 7 2018

Issue description

This was found by skia_image_filter_proto_fuzzer (filter_proto_fuzzer) using MSAN.

REPRODUCTION CASE

1. Build filter_fuzz_stub using the following options:
enable_nacl = false
ffmpeg_branding = "ChromeOS"
is_msan = true
pdf_enable_xfa = true
proprietary_codecs = true
use_libfuzzer = true
use_goma = true
is_debug = false
optimize_for_fuzzing = true

2. Run it on the attached input (ffs-getscale): 

$ ./out/skmsan/filter_fuzz_stub ffs-premult
[0107/020931.673722:INFO:filter_fuzz_stub.cc(61)] Test case: ffs-premult
[0107/020931.677843:INFO:filter_fuzz_stub.cc(38)] Valid stream detected.
==59124==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0xc5fe04 in GetScale third_party/skia/include/core/SkUnPreMultiply.h:29:16
    #1 0xc5fe04 in SkUnPreMultiply::PMColorToColor(unsigned int) third_party/skia/src/core/SkUnPreMultiply.cpp:12
    #2 0x13f3fdc in unpremultiply_bitmap third_party/skia/src/effects/SkMatrixConvolutionImageFilter.cpp:263:25
    #3 0x13f3fdc in SkMatrixConvolutionImageFilter::onFilterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/effects/SkMatrixConvolutionImageFilter.cpp:348
    #4 0xa71d4a in SkImageFilter::filterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/core/SkImageFilter.cpp:213:40
    #5 0x114e2bf in SkBitmapDevice::drawSpecial(SkSpecialImage*, int, int, SkPaint const&, SkImage*, SkMatrix const&) third_party/skia/src/core/SkBitmapDevice.cpp:421:33
    #6 0x9a05d0 in SkCanvas::internalDrawDevice(SkBaseDevice*, int, int, SkPaint const*, SkImage*, SkMatrix const&) third_party/skia/src/core/SkCanvas.cpp:1313:25
    #7 0x998de8 in SkCanvas::internalRestore() third_party/skia/src/core/SkCanvas.cpp:1201:19
    #8 0x9c7e5d in ~AutoDrawLooper third_party/skia/src/core/SkCanvas.cpp:495:22
    #9 0x9c7e5d in SkCanvas::onDrawBitmap(SkBitmap const&, float, float, SkPaint const*) third_party/skia/src/core/SkCanvas.cpp:2308
    #10 0x9b3d6a in SkCanvas::drawBitmap(SkBitmap const&, float, float, SkPaint const*) third_party/skia/src/core/SkCanvas.cpp:1831:11
    #11 0x49601e in RunTestCase skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:48:13
    #12 0x49601e in ReadAndRunTestCase skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:67
    #13 0x49601e in main skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:87
    #14 0x7ff9de6d5f44 in __libc_start_main /build/eglibc-SvCtMH/eglibc-2.19/csu/libc-start.c:287
    #15 0x4243c9 in _start (/usr/local/google/home/metzman/chromium1/src/out/skmsan/filter_fuzz_stub+0x4243c9)

  Uninitialized value was created by a heap allocation
    #0 0x449fbd in __interceptor_malloc /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/msan/msan_interceptors.cc:939:3
    #1 0x190ce16 in base::UncheckedMalloc(unsigned long, void**) base/process/memory_linux.cc:104:13
    #2 0x96d9b2 in sk_malloc_nothrow skia/ext/SkMemory_new_handler.cpp:76:19
    #3 0x96d9b2 in sk_malloc_flags(unsigned long, unsigned int) skia/ext/SkMemory_new_handler.cpp:88
    #4 0xa84540 in sk_malloc_canfail third_party/skia/include/private/SkMalloc.h:102:12
    #5 0xa84540 in MakeUsing third_party/skia/src/core/SkMallocPixelRef.cpp:76
    #6 0xa84540 in SkMallocPixelRef::MakeAllocate(SkImageInfo const&, unsigned long) third_party/skia/src/core/SkMallocPixelRef.cpp:86
    #7 0x973b68 in SkBitmap::tryAllocPixels(SkImageInfo const&, unsigned long) third_party/skia/src/core/SkBitmap.cpp:254:28
    #8 0x13f4e42 in tryAllocPixels third_party/skia/include/core/SkBitmap.h:523:22
    #9 0x13f4e42 in SkMatrixConvolutionImageFilter::onFilterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/effects/SkMatrixConvolutionImageFilter.cpp:359
    #10 0xa71d4a in SkImageFilter::filterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/core/SkImageFilter.cpp:213:40
    #11 0xa7a4b5 in SkImageFilter::filterInput(int, SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/core/SkImageFilter.cpp:512:41
    #12 0x13f2bff in SkMatrixConvolutionImageFilter::onFilterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/effects/SkMatrixConvolutionImageFilter.cpp:290:39
    #13 0xa71d4a in SkImageFilter::filterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/core/SkImageFilter.cpp:213:40
    #14 0x114e2bf in SkBitmapDevice::drawSpecial(SkSpecialImage*, int, int, SkPaint const&, SkImage*, SkMatrix const&) third_party/skia/src/core/SkBitmapDevice.cpp:421:33
    #15 0x9a05d0 in SkCanvas::internalDrawDevice(SkBaseDevice*, int, int, SkPaint const*, SkImage*, SkMatrix const&) third_party/skia/src/core/SkCanvas.cpp:1313:25
    #16 0x998de8 in SkCanvas::internalRestore() third_party/skia/src/core/SkCanvas.cpp:1201:19
    #17 0x9c7e5d in ~AutoDrawLooper third_party/skia/src/core/SkCanvas.cpp:495:22
    #18 0x9c7e5d in SkCanvas::onDrawBitmap(SkBitmap const&, float, float, SkPaint const*) third_party/skia/src/core/SkCanvas.cpp:2308
    #19 0x9b3d6a in SkCanvas::drawBitmap(SkBitmap const&, float, float, SkPaint const*) third_party/skia/src/core/SkCanvas.cpp:1831:11
    #20 0x49601e in RunTestCase skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:48:13
    #21 0x49601e in ReadAndRunTestCase skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:67
    #22 0x49601e in main skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:87
    #23 0x7ff9de6d5f44 in __libc_start_main /build/eglibc-SvCtMH/eglibc-2.19/csu/libc-start.c:287

SUMMARY: MemorySanitizer: use-of-uninitialized-value third_party/skia/include/core/SkUnPreMultiply.h:29:16 in GetScale
Exiting
 
ffs-getscale
388 bytes View Download
Project Member

Comment 1 by ClusterFuzz, Jan 7 2018

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://clusterfuzz.com/testcase?key=4939381873049600.
Project Member

Comment 2 by ClusterFuzz, Jan 7 2018

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://clusterfuzz.com/testcase?key=6439524426317824.
Project Member

Comment 3 by ClusterFuzz, Jan 7 2018

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://clusterfuzz.com/testcase?key=6681008291446784.
Project Member

Comment 4 by ClusterFuzz, Jan 8 2018

Labels: Security_Impact-Stable Security_Severity-Medium
Detailed report: https://clusterfuzz.com/testcase?key=6681008291446784

Job Type: linux_msan_filter_fuzz_stub
Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  SkUnPreMultiply::PMColorToColor
  SkMatrixConvolutionImageFilter::onFilterImage
  SkImageFilter::filterImage
  
Sanitizer: memory (MSAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=linux_msan_filter_fuzz_stub&range=386914:386987

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6681008291446784

See https://github.com/google/clusterfuzz-tools for more information.

A recommended severity was added to this bug. Please change the severity if it is inaccurate.

Project Member

Comment 5 by ClusterFuzz, Jan 8 2018

Cc: robertph...@google.com
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Switch SkMatrixConvolutionImageFilter over to new onFilterImage interface by robertphillips@google.com - https://chromium.googlesource.com/skia/+/dada4dd9cf03e42369ca5b38086dba77f01a68e6

If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 6 by sheriffbot@chromium.org, Jan 8 2018

Labels: M-64
Project Member

Comment 7 by sheriffbot@chromium.org, Jan 8 2018

Labels: Pri-1
Labels: OS-Android OS-Chrome OS-Fuchsia OS-Linux OS-Mac OS-Windows
Status: Available (was: Unconfirmed)

Comment 10 Deleted

Comment 11 by hcm@chromium.org, Jan 8 2018

Cc: hcm@chromium.org reed@google.com
Cc: robertphillips@chromium.org
Cc: kjlubick@chromium.org kjlubick@google.com
Project Member

Comment 14 by bugdroid1@chromium.org, Jan 24 2018

The following revision refers to this bug:
  https://skia.googlesource.com/skia/+/dc3d7fcbb816c8b06c0ab7e6a0aa333c96c8aeef

commit dc3d7fcbb816c8b06c0ab7e6a0aa333c96c8aeef
Author: Robert Phillips <robertphillips@google.com>
Date: Wed Jan 24 20:13:49 2018

Add check for bad enum in SkMatrixConvolutionImageFilter's CreateProc

Bug:  chromium:794402 , chromium:799775 
Change-Id: Ifbc9714b0095c8f4ca44d444bc48514dc90d7f4d
Reviewed-on: https://skia-review.googlesource.com/99203
Commit-Queue: Robert Phillips <robertphillips@google.com>
Reviewed-by: Mike Reed <reed@google.com>

[modify] https://crrev.com/dc3d7fcbb816c8b06c0ab7e6a0aa333c96c8aeef/src/effects/SkMatrixConvolutionImageFilter.cpp

Project Member

Comment 15 by ClusterFuzz, Jan 25 2018

ClusterFuzz has detected this issue as fixed in range 531767:531771.

Detailed report: https://clusterfuzz.com/testcase?key=6681008291446784

Job Type: linux_msan_filter_fuzz_stub
Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  SkUnPreMultiply::PMColorToColor
  SkMatrixConvolutionImageFilter::onFilterImage
  SkImageFilter::filterImage
  
Sanitizer: memory (MSAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=linux_msan_filter_fuzz_stub&range=386914:386987
Fixed: https://clusterfuzz.com/revisions?job=linux_msan_filter_fuzz_stub&range=531767:531771

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6681008291446784

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 16 by ClusterFuzz, Jan 25 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Available)
ClusterFuzz testcase 6681008291446784 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 17 by sheriffbot@chromium.org, Feb 8 2018

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Labels: -M-64 M-66
Labels: Release-0-M66
Project Member

Comment 20 by sheriffbot@chromium.org, May 3 2018

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment