New issue
Advanced search Search tips

Issue 833226 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner: ----
Closed: May 2018
Cc:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 1
Type: Bug



Sign in to add a comment

TestRunnerForSpecificView::CapturePixelsCallback() isn't guarding against large allocations

Project Member Reported by ClusterFuzz, Apr 16 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5036885072936960

Fuzzer: inferno_twister
Job Type: mac_asan_content_shell
Platform Id: mac

Crash Type: Heap-buffer-overflow WRITE 16
Crash Address: 0x000231023100
Crash State:
  ssse3::RGBA_to_BGRA
  SkConvertPixels
  SkPixmap::readPixels
  
Sanitizer: address (ASAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=508470:508529

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5036885072936960

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Apr 16 2018

Components: Internals>Skia
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by sheriffbot@chromium.org, Apr 16 2018

Labels: M-65
Project Member

Comment 3 by sheriffbot@chromium.org, Apr 16 2018

Labels: Pri-1
Owner: reed@google.com
Status: Assigned (was: Untriaged)
reed: Can you take a look and reassign if appropriate? Thanks.
Project Member

Comment 5 by sheriffbot@chromium.org, Apr 18 2018

Labels: -M-65 M-66

Comment 6 by vakh@chromium.org, Apr 23 2018

(security 👮 ping)

reed@ -- can you please prioritize this high priority bug? Thanks.
Project Member

Comment 7 by sheriffbot@chromium.org, Apr 30 2018

reed: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 8 by sheriffbot@chromium.org, May 14 2018

reed: Uh oh! This issue still open and hasn't been updated in the last 28 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 9 by hcm@chromium.org, May 14 2018

Cc: reed@google.com
Owner: mtklein@chromium.org
probably need the other Mike to look here
I can reproduce this locally... with this command so I don't forget:

out/Default/Content\ Shell.app/Contents/MacOS/Content\ Shell --single-process --no-sandbox --run-layout-test ~/Downloads/clusterfuzz-testcase-minimized-5036885072936960.html
Cc: mtklein@chromium.org
Components: -Internals>Skia
Labels: -Type-Bug-Security -Restrict-View-SecurityTeam -Security_Impact-Stable -Security_Severity-High Type-Bug
Owner: ----
Summary: TestRunnerForSpecificView::CapturePixelsCallback() isn't guarding against large allocations (was: Heap-buffer-overflow in ssse3::RGBA_to_BGRA)
I'm not really sure how to fix this, but it doesn't appear to be a problem with Skia.  It also doesn't look like a bug in user-facing Chrome code, just in the test harness?

TestRunnerForSpecificView::CapturePixelsCallback() is trying to read an image into a blink::WebArrayBuffer(), but as written we're passing blink::WebArrayBuffer::Create(size_t, 1) where both its arguments are actually unsigned.  In this case, we ask call Create(0x100339900, 1), and it's truncated to Create(0x00339900, 1), the 3381504 byte region mentioned in the ASAN logs.

It's tempting to try to allocate with something like Create(bufferRowBytes, height) instead, but it really looks like WebArrayBuffer and all its implementation details are fundamentally limited to unsigned, and can't go above 2^32-1.
Project Member

Comment 12 by ClusterFuzz, May 17 2018

Labels: -Reproducible Unreproducible
ClusterFuzz testcase 5036885072936960 appears to be flaky, updating reproducibility label.
Project Member

Comment 13 by ClusterFuzz, May 17 2018

Status: WontFix (was: Assigned)
ClusterFuzz testcase 5036885072936960 is flaky and no longer crashes, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment