New issue
Advanced search Search tips

Issue 809881 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Feb 2018
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Integer-overflow in gl::ValidateReadPixelsBase

Project Member Reported by ClusterFuzz, Feb 7 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6480685079199744

Fuzzer: libFuzzer_gpu_angle_passthrough_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  gl::ValidateReadPixelsBase
  gl::ValidateReadPixelsBase
  gl::ValidateReadPixelsRobustANGLE
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=532616:532633

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6480685079199744

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Feb 7 2018

Labels: Test-Predator-Auto-Owner
Owner: geoffl...@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/177df647cdfd5e76e5eae86fdb0d1038e92fac4a (Make sure the offscreen framebuffer is never resized to zero.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Project Member

Comment 2 by bugdroid1@chromium.org, Feb 22 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/angle/angle/+/a953b52733fad386bc5a6f8d7817da94a5dc0e35

commit a953b52733fad386bc5a6f8d7817da94a5dc0e35
Author: Geoff Lang <geofflang@chromium.org>
Date: Thu Feb 22 18:26:48 2018

Avoid possible overflow when computing ReadPixels bounds.

BUG= 809881 

Change-Id: I69c58c93597aea5a5c25298908592ce1ab4a957b
Reviewed-on: https://chromium-review.googlesource.com/929984
Reviewed-by: Luc Ferron <lucferron@chromium.org>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Commit-Queue: Geoff Lang <geofflang@chromium.org>

[modify] https://crrev.com/a953b52733fad386bc5a6f8d7817da94a5dc0e35/src/libANGLE/validationES.cpp

Project Member

Comment 3 by bugdroid1@chromium.org, Feb 22 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c51c47e07b38d34996924ea92c0b00ca2ea9db25

commit c51c47e07b38d34996924ea92c0b00ca2ea9db25
Author: angle-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <angle-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Thu Feb 22 23:53:01 2018

Roll src/third_party/angle/ 1dce1bd38..f7f0b8c3a (3 commits)

https://chromium.googlesource.com/angle/angle.git/+log/1dce1bd38e1b..f7f0b8c3ab21

$ git log 1dce1bd38..f7f0b8c3a --date=short --no-merges --format='%ad %ae %s'
2018-02-21 oetuaho Rename operator enums so they can be autogenerated
2018-02-20 oetuaho Always add most extension symbols to symbol table
2018-02-21 geofflang Avoid possible overflow when computing ReadPixels bounds.

Created with:
  roll-dep src/third_party/angle
BUG= 809881 


The AutoRoll server is located here: https://angle-chromium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
TBR=fjhenigman@chromium.org

Change-Id: Idd40f7307851637a7ff04e0d7114b00388ed9d7d
Reviewed-on: https://chromium-review.googlesource.com/932913
Reviewed-by: angle-chromium-autoroll <angle-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: angle-chromium-autoroll <angle-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#538621}
[modify] https://crrev.com/c51c47e07b38d34996924ea92c0b00ca2ea9db25/DEPS

Project Member

Comment 4 by bugdroid1@chromium.org, Feb 23 2018

The following revision refers to this bug:
  https://skia.googlesource.com/skia/+/a13dc4059f94bea35ffd5fb9158901fbd0ab9046

commit a13dc4059f94bea35ffd5fb9158901fbd0ab9046
Author: angle-skia-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <angle-skia-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Fri Feb 23 02:43:45 2018

Roll skia/third_party/externals/angle2/ 1dce1bd38..f7f0b8c3a (3 commits)

https://chromium.googlesource.com/angle/angle.git/+log/1dce1bd38e1b..f7f0b8c3ab21

$ git log 1dce1bd38..f7f0b8c3a --date=short --no-merges --format='%ad %ae %s'
2018-02-21 oetuaho Rename operator enums so they can be autogenerated
2018-02-20 oetuaho Always add most extension symbols to symbol table
2018-02-21 geofflang Avoid possible overflow when computing ReadPixels bounds.

Created with:
  roll-dep skia/third_party/externals/angle2
BUG= 809881 


The AutoRoll server is located here: https://angle-skia-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


CQ_INCLUDE_TRYBOTS=skia.primary:Perf-Win10-Clang-AlphaR2-GPU-RadeonR9M470X-x86_64-Debug-All-ANGLE,Perf-Win10-Clang-NUC5i7RYH-GPU-IntelIris6100-x86_64-Debug-All-ANGLE,Perf-Win10-Clang-NUC6i5SYK-GPU-IntelIris540-x86_64-Debug-All-ANGLE,Perf-Win10-Clang-NUCD34010WYKH-GPU-IntelHD4400-x86_64-Debug-All-ANGLE,Perf-Win10-Clang-ShuttleC-GPU-GTX960-x86_64-Debug-All-ANGLE,Test-Win10-Clang-AlphaR2-GPU-RadeonR9M470X-x86_64-Debug-All-ANGLE,Test-Win10-Clang-NUC6i5SYK-GPU-IntelIris540-x86_64-Debug-All-ANGLE,Test-Win10-Clang-NUCD34010WYKH-GPU-IntelHD4400-x86_64-Debug-All-ANGLE,Test-Win10-Clang-ShuttleC-GPU-GTX960-x86_64-Debug-All-ANGLE,Build-Debian9-Clang-x86_64-Release-ANGLE
TBR=djsollen@google.com

Change-Id: I019af148d531ff6eaafa529f59d2c3763234cc55
Reviewed-on: https://skia-review.googlesource.com/109700
Commit-Queue: <angle-skia-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Reviewed-by: <angle-skia-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>

[modify] https://crrev.com/a13dc4059f94bea35ffd5fb9158901fbd0ab9046/DEPS

Project Member

Comment 5 by bugdroid1@chromium.org, Feb 23 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/83df8346ec78d444d6cbf2db4afa216ce0f13f5c

commit 83df8346ec78d444d6cbf2db4afa216ce0f13f5c
Author: skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Fri Feb 23 05:07:58 2018

Roll src/third_party/skia/ 31476b7c9..a13dc4059 (2 commits)

https://skia.googlesource.com/skia.git/+log/31476b7c942f..a13dc4059f94

$ git log 31476b7c9..a13dc4059 --date=short --no-merges --format='%ad %ae %s'
2018-02-23 angle-skia-autoroll Roll skia/third_party/externals/angle2/ 1dce1bd38..f7f0b8c3a (3 commits)
2018-02-23 skcms-skia-autoroll Roll skia/third_party/externals/skcms/ 3b6adcfa3..c5472f44e (1 commit)

Created with:
  roll-dep src/third_party/skia
BUG= 809881 


The AutoRoll server is located here: https://autoroll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
TBR=djsollen@chromium.org

Change-Id: Ifa5679f2e53bde1b50d2a23e7ce5fa4578d226f9
Reviewed-on: https://chromium-review.googlesource.com/933740
Commit-Queue: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Reviewed-by: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#538705}
[modify] https://crrev.com/83df8346ec78d444d6cbf2db4afa216ce0f13f5c/DEPS

Project Member

Comment 6 by ClusterFuzz, Feb 23 2018

ClusterFuzz has detected this issue as fixed in range 538618:538626.

Detailed report: https://clusterfuzz.com/testcase?key=6480685079199744

Fuzzer: libFuzzer_gpu_angle_passthrough_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  gl::ValidateReadPixelsBase
  gl::ValidateReadPixelsBase
  gl::ValidateReadPixelsRobustANGLE
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=532616:532633
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=538618:538626

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6480685079199744

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Feb 23 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6480685079199744 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment