New issue
Advanced search Search tips

Issue 819616 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jun 2018
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Integer-overflow in SkImageInfo::computeByteSize

Project Member Reported by ClusterFuzz, Mar 7 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6031150330675200

Fuzzer: libFuzzer_transfer_cache_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  SkImageInfo::computeByteSize
  cc::ServiceImageTransferCacheEntry::Deserialize
  transfer_cache_fuzzer.cc
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=541281:541292

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6031150330675200

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Mar 7 2018

Components: Internals>Compositing Internals>Skia
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Mar 7 2018

Labels: Test-Predator-Auto-Owner
Owner: enne@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/b346beb380ac646762daa5c561d088afc12f6877 (oop: Add transfer cache deserialization fuzzer).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Project Member

Comment 3 by ClusterFuzz, Mar 7 2018

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/b346beb380ac646762daa5c561d088afc12f6877 (oop: Add transfer cache deserialization fuzzer).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Project Member

Comment 4 by bugdroid1@chromium.org, Jun 8 2018

The following revision refers to this bug:
  https://skia.googlesource.com/skia/+/61e66867ae10451fd365a676747a2c853bdd723d

commit 61e66867ae10451fd365a676747a2c853bdd723d
Author: Adrienne Walker <enne@chromium.org>
Date: Fri Jun 08 17:42:33 2018

Fix SkImageInfo::computeByteSize underflow

Bug: chromium: 819616
Change-Id: I9d4c079ad93518e45739fbb7d1abc32dedbb9c26
Reviewed-on: https://skia-review.googlesource.com/132281
Auto-Submit: Adrienne Walker <enne@chromium.org>
Commit-Queue: Mike Klein <mtklein@google.com>
Reviewed-by: Mike Klein <mtklein@google.com>

[modify] https://crrev.com/61e66867ae10451fd365a676747a2c853bdd723d/src/core/SkImageInfo.cpp

Project Member

Comment 5 by bugdroid1@chromium.org, Jun 9 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ef8fdfca306d8a99f5e1e194b5e1f7fa6a59c08f

commit ef8fdfca306d8a99f5e1e194b5e1f7fa6a59c08f
Author: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Sat Jun 09 17:18:41 2018

Roll src/third_party/skia 7a45dd1..5ebb90d (40 commits)

https://skia.googlesource.com/skia.git/+log/7a45dd1..5ebb90d


git log 7a45dd1..5ebb90d --date=short --no-merges --format='%ad %ae %s'
2018-06-09 senorblanco@chromium.org Revert "remove half float workaround in GrGLGpu::onReadPixels"
2018-06-09 recipe-roller@chromium.org Roll recipe dependencies (trivial).
2018-06-08 mtklein@chromium.org remove unused parts of SkTypes.h
2018-06-08 egdaniel@google.com Fall back to bilerp if we are undable to do a copy for mips.
2018-06-08 egdaniel@google.com Reland "Reland "Require mips to be allocated at texture creation time and disable late allocations.""
2018-06-08 angle-skia-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com Roll third_party/externals/angle2 c3907ef..f15f886 (6 commits)
2018-06-08 bsalomon@google.com Stop passing GrPrimitiveProcessor to GrMesh::sendToGpu.
2018-06-08 herb@google.com Glyph search of desperation
2018-06-08 egdaniel@google.com Revert "Reland "Require mips to be allocated at texture creation time and disable late allocations.""
2018-06-08 borenet@google.com [recipes] Make ct_skps use binaries from a build task
2018-06-08 brianosman@google.com Avoid degenerate matrices (that trigger asserts) in test code
2018-06-08 mtklein@chromium.org see if we can remove this hack
2018-06-08 caryclark@skia.org rebase
2018-06-08 khushalsagar@chromium.org fonts: Perform blob analysis at SkBaseDevice layer instead of canvas.
2018-06-08 mtklein@chromium.org remove unimportant bench
2018-06-08 csmartdalton@google.com Make the SkPathRef GenIDChangeListener ref counted
2018-06-08 bsalomon@google.com Remove include of GrGLProgramBuilder.h from GrGLProgram.h and GrVkPipelineState.h
2018-06-08 csmartdalton@google.com Add a front() accessor to GrAllocator
2018-06-08 herb@google.com New more efficient run builder
2018-06-08 brucewang@google.com Add SkTypeface::makeClone.
2018-06-08 bsalomon@google.com remove half float workaround in GrGLGpu::onReadPixels
2018-06-08 brianosman@google.com Fix A2B JPEG images on GPU backed xform or color-managed canvas
2018-06-08 bungeman@google.com Add text size override to Viewer.
2018-06-08 csmartdalton@google.com Implement Sk2f::floor
2018-06-08 mtklein@chromium.org remove linear blending from SkWebpCodec
2018-06-08 senorblanco@chromium.org GrTessellator: catch missing intersections.
2018-06-08 recipe-roller@chromium.org Roll recipe dependencies (trivial).
2018-06-08 fmalita@chromium.org SkJson
2018-06-08 enne@chromium.org Fix SkImageInfo::computeByteSize underflow
2018-06-08 egdaniel@google.com Reland "Require mips to be allocated at texture creation time and disable late allocations."
2018-06-08 bsalomon@google.com Revert "Reland "Workaround constexpr bug in MSVC 2015 in GrTextureOp""
2018-06-08 caryclark@skia.org update SkColor
2018-06-08 caryclark@skia.org fix define comments
2018-06-08 mtklein@chromium.org remove final SkTypes dependencies in SkArenaAlloc
2018-06-08 benjaminwagner@google.com Remove Win2k8 GPU jobs.
2018-06-08 angle-skia-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com Roll third_party/externals/angle2 81970bc..c3907ef (2 commits)
2018-06-08 timliang@google.com fixed vec3 size differences and mod calculation of skslc msl backend
2018-06-08 brianosman@google.com srgb config is gone. Stop testing it.
2018-06-08 borenet@google.com Update gen_tasks.go to use unforked glog
2018-06-08 robertphillips@google.com Add a factory to any GrOp-derived class that lacked one


Created with:
  gclient setdep -r src/third_party/skia@5ebb90d

The AutoRoll server is located here: https://autoroll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.

CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel

BUG= chromium:830651 , chromium:829622 , chromium:843135 ,chromium: 819616
TBR=halcanary@chromium.org

Change-Id: If58892b6b6b2061e1b52168911b4fb49a1b990e7
Reviewed-on: https://chromium-review.googlesource.com/1094454
Reviewed-by: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#565887}
[modify] https://crrev.com/ef8fdfca306d8a99f5e1e194b5e1f7fa6a59c08f/DEPS

Project Member

Comment 6 by ClusterFuzz, Jun 11 2018

ClusterFuzz has detected this issue as fixed in range 565885:565888.

Detailed report: https://clusterfuzz.com/testcase?key=6031150330675200

Fuzzer: libFuzzer_transfer_cache_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  SkImageInfo::computeByteSize
  cc::ServiceImageTransferCacheEntry::Deserialize
  transfer_cache_fuzzer.cc
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=541281:541292
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=565885:565888

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6031150330675200

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Jun 11 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6031150330675200 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment