New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 822595 link

Starred by 2 users

Issue metadata

Status: Duplicate
Merged: issue 808875
Owner:
Closed: Mar 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security



Sign in to add a comment

Use-of-uninitialized-value in transform_scanline_bgrA

Project Member Reported by ClusterFuzz, Mar 16 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5709169819385856

Fuzzer: inferno_canvas_wrecker
Job Type: linux_msan_chrome
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  transform_scanline_bgrA
  SkPngEncoder::onEncodeRows
  SkEncoder::encodeRows
  
Sanitizer: memory (MSAN)

Recommended Security Severity: Medium

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5709169819385856

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.

Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. We will auto-close the bug if the crash is not seen for 14 days.
 
Project Member

Comment 1 by ClusterFuzz, Mar 16 2018

Components: Internals>Skia
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Comment 2 by est...@chromium.org, Mar 16 2018

Owner: hcm@chromium.org
Status: Assigned (was: Untriaged)
Project Member

Comment 3 by sheriffbot@chromium.org, Mar 17 2018

Labels: Pri-1

Comment 4 by hcm@chromium.org, Mar 19 2018

Cc: kjlubick@chromium.org hcm@chromium.org
Owner: scroggo@chromium.org
Mergedinto: 808875
Status: Duplicate (was: Assigned)
This was previously filed as  issue 808875 . It looks like it's still not reproducible :(

I've already looked through the stacktrace, and it's not obvious there's any problem in transform_scanline_bgrA, SkPngEncoder::onEncodeRows, or SkEncoder::encodeRows.

It's possible that upstack our SkPixmap was not initialized properly, but I don't know enough about that code to make any guesses.
Cc: zakerinasab@chromium.org
Cc: xlai@chromium.org
Project Member

Comment 8 by sheriffbot@chromium.org, Aug 18

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment