Integer-overflow in gl::ValidateReadPixelsBase |
||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6480685079199744 Fuzzer: libFuzzer_gpu_angle_passthrough_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: gl::ValidateReadPixelsBase gl::ValidateReadPixelsBase gl::ValidateReadPixelsRobustANGLE Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=532616:532633 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6480685079199744 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Feb 22 2018
The following revision refers to this bug: https://chromium.googlesource.com/angle/angle/+/a953b52733fad386bc5a6f8d7817da94a5dc0e35 commit a953b52733fad386bc5a6f8d7817da94a5dc0e35 Author: Geoff Lang <geofflang@chromium.org> Date: Thu Feb 22 18:26:48 2018 Avoid possible overflow when computing ReadPixels bounds. BUG= 809881 Change-Id: I69c58c93597aea5a5c25298908592ce1ab4a957b Reviewed-on: https://chromium-review.googlesource.com/929984 Reviewed-by: Luc Ferron <lucferron@chromium.org> Reviewed-by: Corentin Wallez <cwallez@chromium.org> Commit-Queue: Geoff Lang <geofflang@chromium.org> [modify] https://crrev.com/a953b52733fad386bc5a6f8d7817da94a5dc0e35/src/libANGLE/validationES.cpp
,
Feb 22 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/c51c47e07b38d34996924ea92c0b00ca2ea9db25 commit c51c47e07b38d34996924ea92c0b00ca2ea9db25 Author: angle-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <angle-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Date: Thu Feb 22 23:53:01 2018 Roll src/third_party/angle/ 1dce1bd38..f7f0b8c3a (3 commits) https://chromium.googlesource.com/angle/angle.git/+log/1dce1bd38e1b..f7f0b8c3ab21 $ git log 1dce1bd38..f7f0b8c3a --date=short --no-merges --format='%ad %ae %s' 2018-02-21 oetuaho Rename operator enums so they can be autogenerated 2018-02-20 oetuaho Always add most extension symbols to symbol table 2018-02-21 geofflang Avoid possible overflow when computing ReadPixels bounds. Created with: roll-dep src/third_party/angle BUG= 809881 The AutoRoll server is located here: https://angle-chromium-roll.skia.org Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel TBR=fjhenigman@chromium.org Change-Id: Idd40f7307851637a7ff04e0d7114b00388ed9d7d Reviewed-on: https://chromium-review.googlesource.com/932913 Reviewed-by: angle-chromium-autoroll <angle-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Commit-Queue: angle-chromium-autoroll <angle-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#538621} [modify] https://crrev.com/c51c47e07b38d34996924ea92c0b00ca2ea9db25/DEPS
,
Feb 23 2018
The following revision refers to this bug: https://skia.googlesource.com/skia/+/a13dc4059f94bea35ffd5fb9158901fbd0ab9046 commit a13dc4059f94bea35ffd5fb9158901fbd0ab9046 Author: angle-skia-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <angle-skia-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Date: Fri Feb 23 02:43:45 2018 Roll skia/third_party/externals/angle2/ 1dce1bd38..f7f0b8c3a (3 commits) https://chromium.googlesource.com/angle/angle.git/+log/1dce1bd38e1b..f7f0b8c3ab21 $ git log 1dce1bd38..f7f0b8c3a --date=short --no-merges --format='%ad %ae %s' 2018-02-21 oetuaho Rename operator enums so they can be autogenerated 2018-02-20 oetuaho Always add most extension symbols to symbol table 2018-02-21 geofflang Avoid possible overflow when computing ReadPixels bounds. Created with: roll-dep skia/third_party/externals/angle2 BUG= 809881 The AutoRoll server is located here: https://angle-skia-roll.skia.org Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. CQ_INCLUDE_TRYBOTS=skia.primary:Perf-Win10-Clang-AlphaR2-GPU-RadeonR9M470X-x86_64-Debug-All-ANGLE,Perf-Win10-Clang-NUC5i7RYH-GPU-IntelIris6100-x86_64-Debug-All-ANGLE,Perf-Win10-Clang-NUC6i5SYK-GPU-IntelIris540-x86_64-Debug-All-ANGLE,Perf-Win10-Clang-NUCD34010WYKH-GPU-IntelHD4400-x86_64-Debug-All-ANGLE,Perf-Win10-Clang-ShuttleC-GPU-GTX960-x86_64-Debug-All-ANGLE,Test-Win10-Clang-AlphaR2-GPU-RadeonR9M470X-x86_64-Debug-All-ANGLE,Test-Win10-Clang-NUC6i5SYK-GPU-IntelIris540-x86_64-Debug-All-ANGLE,Test-Win10-Clang-NUCD34010WYKH-GPU-IntelHD4400-x86_64-Debug-All-ANGLE,Test-Win10-Clang-ShuttleC-GPU-GTX960-x86_64-Debug-All-ANGLE,Build-Debian9-Clang-x86_64-Release-ANGLE TBR=djsollen@google.com Change-Id: I019af148d531ff6eaafa529f59d2c3763234cc55 Reviewed-on: https://skia-review.googlesource.com/109700 Commit-Queue: <angle-skia-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Reviewed-by: <angle-skia-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> [modify] https://crrev.com/a13dc4059f94bea35ffd5fb9158901fbd0ab9046/DEPS
,
Feb 23 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/83df8346ec78d444d6cbf2db4afa216ce0f13f5c commit 83df8346ec78d444d6cbf2db4afa216ce0f13f5c Author: skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Date: Fri Feb 23 05:07:58 2018 Roll src/third_party/skia/ 31476b7c9..a13dc4059 (2 commits) https://skia.googlesource.com/skia.git/+log/31476b7c942f..a13dc4059f94 $ git log 31476b7c9..a13dc4059 --date=short --no-merges --format='%ad %ae %s' 2018-02-23 angle-skia-autoroll Roll skia/third_party/externals/angle2/ 1dce1bd38..f7f0b8c3a (3 commits) 2018-02-23 skcms-skia-autoroll Roll skia/third_party/externals/skcms/ 3b6adcfa3..c5472f44e (1 commit) Created with: roll-dep src/third_party/skia BUG= 809881 The AutoRoll server is located here: https://autoroll.skia.org Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel TBR=djsollen@chromium.org Change-Id: Ifa5679f2e53bde1b50d2a23e7ce5fa4578d226f9 Reviewed-on: https://chromium-review.googlesource.com/933740 Commit-Queue: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Reviewed-by: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#538705} [modify] https://crrev.com/83df8346ec78d444d6cbf2db4afa216ce0f13f5c/DEPS
,
Feb 23 2018
ClusterFuzz has detected this issue as fixed in range 538618:538626. Detailed report: https://clusterfuzz.com/testcase?key=6480685079199744 Fuzzer: libFuzzer_gpu_angle_passthrough_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: gl::ValidateReadPixelsBase gl::ValidateReadPixelsBase gl::ValidateReadPixelsRobustANGLE Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=532616:532633 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=538618:538626 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6480685079199744 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Feb 23 2018
ClusterFuzz testcase 6480685079199744 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||
►
Sign in to add a comment |
||
Comment 1 by ClusterFuzz
, Feb 7 2018Owner: geoffl...@chromium.org
Status: Assigned (was: Untriaged)