ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://clusterfuzz.com/testcase?key=6409661350936576.

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://clusterfuzz.com/testcase?key=6621085813702656.

Detailed report: https://clusterfuzz.com/testcase?key=6621085813702656

Job Type: linux_asan_chrome_mp
Crash Type: Heap-buffer-overflow READ {*}
Crash Address: 0x617000059400
Crash State:
  gpu::gles2::GLES2Implementation::TexImage3D
  blink::WebGLRenderingContextBase::TexImageHelperImageData
  blink::WebGL2RenderingContextBase::texImage3D
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=495528:495531

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6621085813702656

See https://github.com/google/clusterfuzz-tools for more information.

A recommended severity was added to this bug. Please change the severity if it is inaccurate.

Out of curiosity, why would CF assign this a Medium rating?

bajones: could you ptal? 

bajones: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Brandon are you looking into this?

Could you please mark this bug as started or let me know if it should be assigned to someone else?

Thank you

bajones: Uh oh! This issue still open and hasn't been updated in the last 28 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Friendly ping from the security sheriff. Can we get any update on this?

It's been a while since there has been an update to this. Can I get an update on this?

kainino: Can you take a look? (bajones pointed me your way)

Sure, I'll take a look (probably tomorrow)

#7: I'm guessing it's Severity-Medium because it's a buffer overflow in the renderer process (page/JS process). The renderer process is sandboxed and relatively untrusted, so it isn't high severity.

In particular, Site Isolation (origin-per-process, also used as a Spectre mitigation), makes this even less of an attack vector.

However, of course, we should still fix it as any buffer overrun is dangerous.

Sorry, missed the question in #7. But #19 is right: buffer overflows start as High, but get lowered to Medium with mitigating factors (e.g., confined to renderer sandbox).

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b43de74aa37a65c608308a122098204ab9c2702f

commit b43de74aa37a65c608308a122098204ab9c2702f
Author: Kai Ninomiya <kainino@chromium.org>
Date: Wed May 16 03:48:25 2018

fix incorrect TexImage3D params w/ UNPACK_IMAGE_HEIGHT

Bug:  804123 
Test: http://github.com/KhronosGroup/WebGL/pull/2646
Cq-Include-Trybots: luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel
Change-Id: Ifbce9b93f0b35817881e1e34930cbac22a1e8b98
Reviewed-on: https://chromium-review.googlesource.com/1053573
Reviewed-by: Kenneth Russell <kbr@chromium.org>
Commit-Queue: Kai Ninomiya <kainino@chromium.org>
Cr-Commit-Position: refs/heads/master@{#558962}
[modify] https://crrev.com/b43de74aa37a65c608308a122098204ab9c2702f/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc

ClusterFuzz has detected this issue as fixed in range 558961:558963.

Detailed report: https://clusterfuzz.com/testcase?key=6621085813702656

Job Type: linux_asan_chrome_mp
Crash Type: Heap-buffer-overflow READ {*}
Crash Address: 0x617000059400
Crash State:
  gpu::gles2::GLES2Implementation::TexImage3D
  blink::WebGLRenderingContextBase::TexImageHelperImageData
  blink::WebGL2RenderingContextBase::texImage3D
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=495528:495531
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=558961:558963

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6621085813702656

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6621085813702656 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

*** Boilerplate reminders! ***
Please do NOT publicly disclose details until a fix has been released to all our users. Early public disclosure may cancel the provisional reward. Also, please be considerate about disclosure when the bug affects a core library that may be used by other products. Please do NOT share this information with third parties who are not directly involved in fixing the bug. Doing so may cancel the provisional reward. Please be honest if you have already disclosed anything publicly or to third parties. Lastly, we understand that some of you are not interested in money. We offer the option to donate your reward to an eligible charity. If you prefer this option, let us know and we will also match your donation - subject to our discretion. Any rewards that are unclaimed after 12 months will be donated to a charity of our choosing.
*********************************

Nice one! The VRP panel decided to reward $1,000 for this report. Thanks!

This bug requires manual review: M68 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), kariahda@(iOS), bhthompson@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot