New issue
Advanced search Search tips

Issue 835540 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Abrt in sk_abort_no_print

Project Member Reported by ClusterFuzz, Apr 21 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5597757872799744

Fuzzer: libFuzzer_skia_color_space_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x053900001bf7
Crash State:
  sk_abort_no_print
  cs_to_profile
  cs_to_profile
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=552548:552566

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5597757872799744

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Apr 21 2018

Components: Internals>Skia
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Apr 21 2018

Cc: brianosman@google.com
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Enable skcms in Skia by brianosman@google.com - https://chromium.googlesource.com/chromium/src/+/a3796c2471b11c81c8b532d66388c1b5ea708c07

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Cc: -brianosman@google.com mtklein@chromium.org
Owner: brianosman@chromium.org
Status: Assigned (was: Untriaged)
This is harmless. We didn't anticipate invalid profiles reaching this code, so it asserts. It then proceeds to reject the profile, so I'll simply remove the assert to avoid this crash during fuzzing.
Project Member

Comment 4 by bugdroid1@chromium.org, Apr 22 2018

The following revision refers to this bug:
  https://skia.googlesource.com/skia/+/e03a8ac962ab7b475a213657d39a78f5992f1962

commit e03a8ac962ab7b475a213657d39a78f5992f1962
Author: Brian Osman <brianosman@google.com>
Date: Sun Apr 22 14:36:56 2018

Remove assert that color spaces have valid profile data

Chrome fuzzing can trigger this code with malformed profile data
(which suggests that the older SkColorSpace::MakeICC allowed some
invalid profile data to slip through). In any case, simply returning
false to reject the profile is fine.

Bug:  chromium:835540 
Change-Id: Ib675b8e9e3be444ad5dbf8153d60d86284682c90
Reviewed-on: https://skia-review.googlesource.com/122940
Auto-Submit: Brian Osman <brianosman@google.com>
Reviewed-by: Mike Klein <mtklein@chromium.org>
Commit-Queue: Mike Klein <mtklein@google.com>

[modify] https://crrev.com/e03a8ac962ab7b475a213657d39a78f5992f1962/src/core/SkColorSpaceXform_skcms.cpp

Project Member

Comment 5 by bugdroid1@chromium.org, Apr 22 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a1a823a3a67fdca534085123cc6b3adc6606ae56

commit a1a823a3a67fdca534085123cc6b3adc6606ae56
Author: skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Sun Apr 22 17:42:45 2018

Roll src/third_party/skia/ 5209d7fce..20f8bd771 (2 commits)

https://skia.googlesource.com/skia.git/+log/5209d7fce35f..20f8bd771119

$ git log 5209d7fce..20f8bd771 --date=short --no-merges --format='%ad %ae %s'
2018-04-20 angle-skia-autoroll Roll third_party/externals/angle2/ 3ec304dba..aecfa71b4 (6 commits)
2018-04-21 brianosman Remove assert that color spaces have valid profile data

Created with:
  roll-dep src/third_party/skia
BUG= chromium:835540 


The AutoRoll server is located here: https://autoroll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel
TBR=stani@chromium.org

Change-Id: I210d092c0c7906de0b663fdf1a110f2f56da4764
Reviewed-on: https://chromium-review.googlesource.com/1023593
Reviewed-by: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#552608}
[modify] https://crrev.com/a1a823a3a67fdca534085123cc6b3adc6606ae56/DEPS

Project Member

Comment 6 by ClusterFuzz, Apr 23 2018

ClusterFuzz has detected this issue as fixed in range 552607:552608.

Detailed report: https://clusterfuzz.com/testcase?key=5597757872799744

Fuzzer: libFuzzer_skia_color_space_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x053900001bf7
Crash State:
  sk_abort_no_print
  cs_to_profile
  cs_to_profile
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=552548:552566
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=552607:552608

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5597757872799744

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Apr 23 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5597757872799744 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment