ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://clusterfuzz.com/testcase?key=4780819080806400.

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://clusterfuzz.com/testcase?key=5069222267584512.

Detailed report: https://clusterfuzz.com/testcase?key=5069222267584512

Fuzzer: libFuzzer_gpu_swiftshader_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Heap-buffer-overflow READ 4
Crash Address: 0x60a000032cd0
Crash State:
  sw::Surface::Buffer::read
  sw::Surface::copyInternal
  sw::Blitter::blit3D
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=539216:539237

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5069222267584512

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

A recommended severity was added to this bug. Please change the severity if it is inaccurate.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/27a33c6510b49dda52c27035e4b580738b653a0f (Remove gpu workaround code that no config specifies).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

I bisected my patch to make sure I hadn't messed up any logic, and I was able to "fix" the issue by adding the following lines.

diff --git a/gpu/config/gpu_driver_bug_workaround_type.h b/gpu/config/gpu_driver_bug_workaround_type.h
index 690ad3c9038e..6f4ca73fdcbd 100644
--- a/gpu/config/gpu_driver_bug_workaround_type.h
+++ b/gpu/config/gpu_driver_bug_workaround_type.h
@@ -25,6 +25,10 @@
          avoid_stencil_buffers)                              \
   GPU_OP(BROKEN_EGL_IMAGE_REF_COUNTING,                      \
          broken_egl_image_ref_counting)                      \
+  GPU_OP(TESTING1,                                           \
+         testing1)                                           \
+  GPU_OP(TESTING2,                                           \
+         testing2)                                           \
   GPU_OP(CLEAR_TO_ZERO_OR_ONE_BROKEN,                        \
          clear_to_zero_or_one_broken)                        \
   GPU_OP(CLEAR_UNIFORMS_BEFORE_FIRST_PROGRAM_USE,            \


So, it seems my patch looks like the cause in the bisect because it changed workaround ids.

Assigning to swiftshader folks to take a look for the real underlying bug.

Thanks Enne. It looks like this might be closely related to  Issue 825252 .

Detailed report: https://clusterfuzz.com/testcase?key=5069222267584512

Fuzzer: libFuzzer_gpu_swiftshader_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Heap-buffer-overflow READ 4
Crash Address: 0x60a000032cd0
Crash State:
  sw::Surface::Buffer::read
  sw::Surface::copyInternal
  sw::Blitter::blit3D
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=539216:539237

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5069222267584512

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

I managed to reproduce the issue using the file provided by OP, but not with the clusterfuzz reproduce tool.

That sounds bad, thanks for the heads up. Did you try it with https://clusterfuzz.com/v2/testcase-detail/5069222267584512?noredirect=1 ?

Yes, that's the one I tried.

filed - https://github.com/google/clusterfuzz-tools/issues/532

Thanks!

Back to the cause of the crash: I found out that this testcase is creating a 256x0x4 volume texture (note the 0 height), and then wants to generate mipmaps for it.

The OpenGL spec states that it results in a texture with log2(maxsize) + 1 mipmap levels, and the other levels' dimensions are max(1,width>>1) x max(1,height>>1) x max(1,depth>>1). So the second mipmap level is 128x1x2, and trying to copy filtered texels from the base level into it causes a crash because it has none.

The simple fix is to not attempt to read from a texture where one of the dimensions is 0. Our mipmap generation for 2D textures has that safeguard.

That said, it feels like a spec bug. After calling glGenerateMipmap(), the texture should be 'mipmap complete'. The desktop OpenGL specification is explicit about this. But this can't be satisfied with a base level that has a 0 dimension.

Filed https://gitlab.khronos.org/opengl/API/issues/72 to get clarification on this from Khronos. In the meantime I'll fix the crash by checking for zero dimensions before trying to filter/blit between images.

The following revision refers to this bug:
  https://swiftshader.googlesource.com/SwiftShader.git/+/f8cdc74c4b4afca9f1f807d9fda6ea8d530b358e

commit f8cdc74c4b4afca9f1f807d9fda6ea8d530b358e
Author: Nicolas Capens <capn@google.com>
Date: Thu Mar 29 13:21:17 2018

Guard against copying from a zero-sized 3D image.

 Bug chromium:825545 

Change-Id: I37d6192bf65115938943f45d43e153196a7d569a
Reviewed-on: https://swiftshader-review.googlesource.com/18128
Tested-by: Nicolas Capens <nicolascapens@google.com>
Reviewed-by: Alexis Hétu <sugoi@google.com>

[modify] https://crrev.com/f8cdc74c4b4afca9f1f807d9fda6ea8d530b358e/src/OpenGL/libGLESv2/Device.cpp

Note that this bug is causing us to copy out-of-bounds data into a texture image which can then be read from JavaScript using framebufferTextureLayer and readPixels. It's not a verbatim copy of the data; it's filtering it by averaging pairs of pixels. Still, if the data is a high-resolution image then a downsampled version could be a readable version of sensitive information.

Of course an attacker would have other hurdles to overcome, but it's not great to have to depend on those. So I'm requesting a merge to M66.

This bug requires manual review: M66 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), josafat@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Please mark security bugs as fixed as soon as the fix lands, and before requesting merges. This update is based on the merge- labels applied to this issue. Please reopen if this update was incorrect.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Let's let it bake in canary first, and we can review merge tomorrow.

The fix only landed upstream so far. DEPS roll is in progress: https://chromium-review.googlesource.com/c/chromium/src/+/985899 Agreed that once it has landed we should check how it fares in Canary for a bit.

Detailed report: https://clusterfuzz.com/testcase?key=5069222267584512

Fuzzer: libFuzzer_gpu_swiftshader_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Heap-buffer-overflow READ 4
Crash Address: 0x60a000032cd0
Crash State:
  sw::Surface::Buffer::read
  sw::Surface::copyInternal
  sw::Blitter::blit3D
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=539216:539237

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5069222267584512

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

The DEPS roll has landed, but clusterfuzz has been showing "Fixed: Pending" for a whole day. I've verified the patch locally, so I think this might be another clusterfuzz issue.

ClusterFuzz has detected this issue as fixed in range 546920:546945.

Detailed report: https://clusterfuzz.com/testcase?key=5069222267584512

Fuzzer: libFuzzer_gpu_swiftshader_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Heap-buffer-overflow READ 4
Crash Address: 0x60a000032cd0
Crash State:
  sw::Surface::Buffer::read
  sw::Surface::copyInternal
  sw::Blitter::blit3D
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=539216:539237
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=546920:546945

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5069222267584512

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5069222267584512 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Can you please confirm if #17 still needs to be merged to M66?

I think so, as per c#18. capn@ seems to be OOO today due to the public holiday.

Approving merge to M66. Branch:3359

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chrome-internal.googlesource.com/chrome/tools/buildspec/+/0a0bbed01d834dbe6fcb56423df2360043368ea4

commit 0a0bbed01d834dbe6fcb56423df2360043368ea4
Author: Nicolas Capens <capn@google.com>
Date: Tue Apr 10 20:45:07 2018

thanks!

The following revision refers to this bug:
  https://swiftshader.googlesource.com/SwiftShader.git/+/89c43d202302ec20e0d3b31d7273fed848b9ee23

commit 89c43d202302ec20e0d3b31d7273fed848b9ee23
Author: Nicolas Capens <capn@google.com>
Date: Wed May 16 20:44:10 2018

Ignore glGenerateMipmap for unspecified or zero-sized textures.

https://gitlab.khronos.org/opengl/API/issues/72 was resolved to treat
these cases as a no-op and not generate an error.

 Bug chromium:825545 

Change-Id: Ic4cfbc728156bb88a6dc70486ae57c3e12ea43ae
Reviewed-on: https://swiftshader-review.googlesource.com/18870
Tested-by: Nicolas Capens <nicolascapens@google.com>
Reviewed-by: Alexis Hétu <sugoi@google.com>

[modify] https://crrev.com/89c43d202302ec20e0d3b31d7273fed848b9ee23/src/OpenGL/libGLESv2/Texture.cpp
[modify] https://crrev.com/89c43d202302ec20e0d3b31d7273fed848b9ee23/src/OpenGL/libGLESv2/utilities.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/997bfdbc7f496a31e1675680d6b8ca098cd3884c

commit 997bfdbc7f496a31e1675680d6b8ca098cd3884c
Author: Nicolas Capens <capn@chromium.org>
Date: Fri May 18 21:19:56 2018

Roll SwiftShader c8403ec..cbb80f5

https://swiftshader.googlesource.com/SwiftShader.git/+log/c8403ec..cbb80f5

BUG= chromium:835299 , chromium:825545 

TBR=kbr@chromium.org

TEST=bots

CQ_INCLUDE_TRYBOTS=luci.chromium.try:win_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_chromium_cfi_rel_ng;luci.chromium.try:android_optional_gpu_tests_rel

Change-Id: Ic37afa51eaa67f7a61902d2a3e2d8227065ae909
Reviewed-on: https://chromium-review.googlesource.com/1066397
Reviewed-by: Alexis Hétu <sugoi@chromium.org>
Commit-Queue: Nicolas Capens <capn@chromium.org>
Cr-Commit-Position: refs/heads/master@{#560042}
[modify] https://crrev.com/997bfdbc7f496a31e1675680d6b8ca098cd3884c/DEPS

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot