Security: use-of-uninitialized-value in unpremul_pm (filter_fuzz_stub) |
|||||||||||
Issue description
This was found by skia_image_filter_proto_fuzzer (filter_proto_fuzzer).
REPRODUCTION CASE
1. Build filter_fuzz_stub using the following options:
enable_nacl = false
ffmpeg_branding = "ChromeOS"
is_msan = true
pdf_enable_xfa = true
proprietary_codecs = true
use_libfuzzer = true
use_goma = true
is_debug = false
2. Run it on the attatched testcase (ffs-unpremul_pm):
$ ./out/skmsan/filter_fuzz_stub ffs-unpremul_pm
[0122/130224.672756:INFO:filter_fuzz_stub.cc(61)] Test case: ffs-unpremul_pm
[0122/130224.673696:INFO:filter_fuzz_stub.cc(38)] Valid stream detected.
==70618==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x13a8bb5 in unpremul_pm third_party/skia/src/effects/SkDisplacementMapEffect.cpp:60:9
#1 0x13a8bb5 in computeDisplacement third_party/skia/src/effects/SkDisplacementMapEffect.cpp:86
#2 0x13a8bb5 in SkDisplacementMapEffect::onFilterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/effects/SkDisplacementMapEffect.cpp:355
#3 0xa73bea in SkImageFilter::filterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/core/SkImageFilter.cpp:212:40
#4 0xa7c1d5 in SkImageFilter::filterInput(int, SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/core/SkImageFilter.cpp:511:41
#5 0x13a2bbf in SkDisplacementMapEffect::onFilterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/effects/SkDisplacementMapEffect.cpp:246:39
#6 0xa73bea in SkImageFilter::filterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/core/SkImageFilter.cpp:212:40
#7 0x1162e5e in SkBitmapDevice::drawSpecial(SkSpecialImage*, int, int, SkPaint const&, SkImage*, SkMatrix const&) third_party/skia/src/core/SkBitmapDevice.cpp:424:33
#8 0x99e59a in SkCanvas::internalDrawDevice(SkBaseDevice*, int, int, SkPaint const*, SkImage*, SkMatrix const&) third_party/skia/src/core/SkCanvas.cpp:1316:25
#9 0x996c49 in SkCanvas::internalRestore() third_party/skia/src/core/SkCanvas.cpp:1204:19
#10 0x9c642d in ~AutoDrawLooper third_party/skia/src/core/SkCanvas.cpp:495:22
#11 0x9c642d in SkCanvas::onDrawBitmap(SkBitmap const&, float, float, SkPaint const*) third_party/skia/src/core/SkCanvas.cpp:2314
#12 0x9b220a in SkCanvas::drawBitmap(SkBitmap const&, float, float, SkPaint const*) third_party/skia/src/core/SkCanvas.cpp:1837:11
#13 0x496bee in RunTestCase skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:48:13
#14 0x496bee in ReadAndRunTestCase skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:67
#15 0x496bee in main skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:87
#16 0x7f001add92b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
#17 0x424fd9 in _start (/usr/local/google/home/metzman/chromium1/src/out/skmsan/filter_fuzz_stub+0x424fd9)
Uninitialized value was created by a heap allocation
#0 0x44abcd in __interceptor_malloc /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/msan/msan_interceptors.cc:939:3
#1 0x19264d6 in base::UncheckedMalloc(unsigned long, void**) base/process/memory_linux.cc:105:13
#2 0x96c5e5 in malloc_nothrow skia/ext/SkMemory_new_handler.cpp:76:19
#3 0x96c5e5 in sk_malloc_flags(unsigned long, unsigned int) skia/ext/SkMemory_new_handler.cpp:115
#4 0xa86280 in sk_malloc_canfail third_party/skia/include/private/SkMalloc.h:79:12
#5 0xa86280 in MakeUsing third_party/skia/src/core/SkMallocPixelRef.cpp:76
#6 0xa86280 in SkMallocPixelRef::MakeAllocate(SkImageInfo const&, unsigned long) third_party/skia/src/core/SkMallocPixelRef.cpp:86
#7 0x97181d in SkBitmap::tryAllocPixels(SkImageInfo const&, unsigned long) third_party/skia/src/core/SkBitmap.cpp:234:28
#8 0x1407bc2 in tryAllocPixels third_party/skia/include/core/SkBitmap.h:517:22
#9 0x1407bc2 in SkMatrixConvolutionImageFilter::onFilterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/effects/SkMatrixConvolutionImageFilter.cpp:359
#10 0xa73bea in SkImageFilter::filterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/core/SkImageFilter.cpp:212:40
#11 0xa7c1d5 in SkImageFilter::filterInput(int, SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/core/SkImageFilter.cpp:511:41
#12 0x13a2bbf in SkDisplacementMapEffect::onFilterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/effects/SkDisplacementMapEffect.cpp:246:39
#13 0xa73bea in SkImageFilter::filterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/core/SkImageFilter.cpp:212:40
#14 0xa7c1d5 in SkImageFilter::filterInput(int, SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/core/SkImageFilter.cpp:511:41
#15 0x13a2bbf in SkDisplacementMapEffect::onFilterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/effects/SkDisplacementMapEffect.cpp:246:39
#16 0xa73bea in SkImageFilter::filterImage(SkSpecialImage*, SkImageFilter::Context const&, SkIPoint*) const third_party/skia/src/core/SkImageFilter.cpp:212:40
#17 0x1162e5e in SkBitmapDevice::drawSpecial(SkSpecialImage*, int, int, SkPaint const&, SkImage*, SkMatrix const&) third_party/skia/src/core/SkBitmapDevice.cpp:424:33
#18 0x99e59a in SkCanvas::internalDrawDevice(SkBaseDevice*, int, int, SkPaint const*, SkImage*, SkMatrix const&) third_party/skia/src/core/SkCanvas.cpp:1316:25
#19 0x996c49 in SkCanvas::internalRestore() third_party/skia/src/core/SkCanvas.cpp:1204:19
#20 0x9c642d in ~AutoDrawLooper third_party/skia/src/core/SkCanvas.cpp:495:22
#21 0x9c642d in SkCanvas::onDrawBitmap(SkBitmap const&, float, float, SkPaint const*) third_party/skia/src/core/SkCanvas.cpp:2314
#22 0x9b220a in SkCanvas::drawBitmap(SkBitmap const&, float, float, SkPaint const*) third_party/skia/src/core/SkCanvas.cpp:1837:11
#23 0x496bee in RunTestCase skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:48:13
#24 0x496bee in ReadAndRunTestCase skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:67
#25 0x496bee in main skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:87
#26 0x7f001add92b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
SUMMARY: MemorySanitizer: use-of-uninitialized-value third_party/skia/src/effects/SkDisplacementMapEffect.cpp:60:9 in unpremul_pm
Exiting
,
Jan 22 2018
Detailed report: https://clusterfuzz.com/testcase?key=6529243038351360 Job Type: linux_msan_filter_fuzz_stub Crash Type: Use-of-uninitialized-value Crash Address: Crash State: SkDisplacementMapEffect::onFilterImage SkImageFilter::filterImage SkImageFilter::filterInput Sanitizer: memory (MSAN) Recommended Security Severity: Medium Regressed: https://clusterfuzz.com/revisions?job=linux_msan_filter_fuzz_stub&range=480271:480453 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6529243038351360 See https://github.com/google/clusterfuzz-tools for more information. A recommended severity was added to this bug. Please change the severity if it is inaccurate.
,
Jan 22 2018
Automatically adding ccs based on suspected regression changelists: reduce SkDisplacementImageFilter size. by reed@google.com - https://skia.googlesource.com/skia/+/1a74c531058ceecd10703da26b4729f4427d1f33 imagefilters should take const array by reed@google.com - https://skia.googlesource.com/skia/+/ce6b4b004b2842e61cd9f86ebb75d1872044b382 If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
,
Jan 22 2018
Not sure if the issue is related to this one but issue 799775 is a use-of-unitialized-value in SkUnPreMultiply.h.
,
Jan 23 2018
,
Jan 23 2018
,
Jan 25 2018
ClusterFuzz has detected this issue as fixed in range 531767:531771. Detailed report: https://clusterfuzz.com/testcase?key=6529243038351360 Job Type: linux_msan_filter_fuzz_stub Crash Type: Use-of-uninitialized-value Crash Address: Crash State: SkDisplacementMapEffect::onFilterImage SkImageFilter::filterImage SkImageFilter::filterInput Sanitizer: memory (MSAN) Recommended Security Severity: Medium Regressed: https://clusterfuzz.com/revisions?job=linux_msan_filter_fuzz_stub&range=480271:480453 Fixed: https://clusterfuzz.com/revisions?job=linux_msan_filter_fuzz_stub&range=531767:531771 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6529243038351360 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jan 25 2018
ClusterFuzz testcase 6529243038351360 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Feb 5 2018
,
Feb 8 2018
,
Mar 6 2018
,
Apr 17 2018
,
May 3 2018
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||
►
Sign in to add a comment |
|||||||||||
Comment 1 by ClusterFuzz
, Jan 22 2018