New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 827011 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in cc::PaintImage::width

Project Member Reported by ClusterFuzz, Mar 29 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5421471594446848

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x00000000000c
Crash State:
  cc::PaintImage::width
  cc::DecodedImageTracker::QueueImageDecode
  cc::LayerTreeHostImpl::QueueImageDecode
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=538992:538995

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5421471594446848

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Mar 29 2018

Components: Internals>Compositing
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: vmp...@chromium.org brajkumar@chromium.org
Components: Blink>Image
Labels: M-66 Test-Predator-Wrong CF-NeedsTriage
Unable to find actual suspect through code search and also observing no related changes under regression range, hence adding appropriate label and requesting someone from blink team to look in to this issue.

Thanks!
Components: -Blink>Image
Owner: khushals...@chromium.org
Status: Assigned (was: Untriaged)
Khushal, can you take a look at this please?
Its crashing the first time we access an image from QueueImageDecode from the main thread. Just needs a null check in LayerTreeHost::QueueImageDecode.
Project Member

Comment 6 by ClusterFuzz, Apr 18 2018

ClusterFuzz has detected this issue as fixed in range 551565:551568.

Detailed report: https://clusterfuzz.com/testcase?key=5421471594446848

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x00000000000c
Crash State:
  cc::PaintImage::width
  cc::DecodedImageTracker::QueueImageDecode
  cc::LayerTreeHostImpl::QueueImageDecode
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=538992:538995
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=551565:551568

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5421471594446848

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Apr 18 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5421471594446848 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment