New issue
Advanced search Search tips

Issue 836638 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Apr 2018
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Float-cast-overflow in blink::BaseRenderingContext2D::createLinearGradient

Project Member Reported by ClusterFuzz, Apr 25 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5720234972151808

Fuzzer: inferno_twister_c
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  blink::BaseRenderingContext2D::createLinearGradient
  createLinearGradientMethod
  blink::V8CanvasRenderingContext2D::createLinearGradientMethodCallback
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=552707:552711

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5720234972151808

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Apr 25 2018

Components: Blink>Canvas
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Comment 2 by junov@chromium.org, Apr 25 2018

Owner: fs...@chromium.org
Status: Assigned (was: Untriaged)
Project Member

Comment 3 by bugdroid1@chromium.org, Apr 26 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b88abf494b5c52e22e54a1318584f1335d41e98c

commit b88abf494b5c52e22e54a1318584f1335d41e98c
Author: Reza.Zakerinasab <zakerinasab@chromium.org>
Date: Thu Apr 26 19:20:07 2018

Fix float cast overflow in canvas

Canvas API use double parameters in IDL entry points, but many
utility functions and objects in Blink use SkScalar, which is
equal to float. This results in float cast overflows when the
input double param is casted to a SkScalar. This CL fixes this
by clamping the input params from double to float beforehand.

Bug:  836931 , 836840 , 836708 , 836685 , 836638 
Change-Id: I250c2d1dfc4a60916dee9843c36a5a3a513e7912
Reviewed-on: https://chromium-review.googlesource.com/1030615
Reviewed-by: Justin Novosad <junov@chromium.org>
Commit-Queue: Mohammad Reza Zakerinasab <zakerinasab@chromium.org>
Cr-Commit-Position: refs/heads/master@{#554114}
[modify] https://crrev.com/b88abf494b5c52e22e54a1318584f1335d41e98c/third_party/blink/renderer/modules/canvas/canvas2d/base_rendering_context_2d.cc
[modify] https://crrev.com/b88abf494b5c52e22e54a1318584f1335d41e98c/third_party/blink/renderer/modules/canvas/canvas2d/canvas_rendering_context_2d.cc
[modify] https://crrev.com/b88abf494b5c52e22e54a1318584f1335d41e98c/third_party/blink/renderer/modules/canvas/canvas2d/canvas_rendering_context_2d_state.cc
[modify] https://crrev.com/b88abf494b5c52e22e54a1318584f1335d41e98c/third_party/blink/renderer/modules/canvas/canvas2d/canvas_rendering_context_2d_state.h

Project Member

Comment 4 by ClusterFuzz, Apr 27 2018

ClusterFuzz has detected this issue as fixed in range 554111:554115.

Detailed report: https://clusterfuzz.com/testcase?key=5720234972151808

Fuzzer: inferno_twister_c
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  blink::BaseRenderingContext2D::createLinearGradient
  createLinearGradientMethod
  blink::V8CanvasRenderingContext2D::createLinearGradientMethodCallback
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=552707:552711
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=554111:554115

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5720234972151808

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Apr 27 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5720234972151808 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment