New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 836840 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Apr 2018
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Float-cast-overflow in blink::CanvasRenderingContext2DState::SetLineWidth

Project Member Reported by ClusterFuzz, Apr 25 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6567584640794624

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  blink::CanvasRenderingContext2DState::SetLineWidth
  lineWidthAttributeSetter
  blink::V8CanvasRenderingContext2D::lineWidthAttributeSetterCallback
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=552707:552711

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6567584640794624

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Apr 25 2018

Components: Blink>Canvas
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Comment 2 by junov@chromium.org, Apr 25 2018

Owner: junov@chromium.org
Status: Assigned (was: Untriaged)
Project Member

Comment 3 by bugdroid1@chromium.org, Apr 26 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b88abf494b5c52e22e54a1318584f1335d41e98c

commit b88abf494b5c52e22e54a1318584f1335d41e98c
Author: Reza.Zakerinasab <zakerinasab@chromium.org>
Date: Thu Apr 26 19:20:07 2018

Fix float cast overflow in canvas

Canvas API use double parameters in IDL entry points, but many
utility functions and objects in Blink use SkScalar, which is
equal to float. This results in float cast overflows when the
input double param is casted to a SkScalar. This CL fixes this
by clamping the input params from double to float beforehand.

Bug:  836931 , 836840 , 836708 , 836685 , 836638 
Change-Id: I250c2d1dfc4a60916dee9843c36a5a3a513e7912
Reviewed-on: https://chromium-review.googlesource.com/1030615
Reviewed-by: Justin Novosad <junov@chromium.org>
Commit-Queue: Mohammad Reza Zakerinasab <zakerinasab@chromium.org>
Cr-Commit-Position: refs/heads/master@{#554114}
[modify] https://crrev.com/b88abf494b5c52e22e54a1318584f1335d41e98c/third_party/blink/renderer/modules/canvas/canvas2d/base_rendering_context_2d.cc
[modify] https://crrev.com/b88abf494b5c52e22e54a1318584f1335d41e98c/third_party/blink/renderer/modules/canvas/canvas2d/canvas_rendering_context_2d.cc
[modify] https://crrev.com/b88abf494b5c52e22e54a1318584f1335d41e98c/third_party/blink/renderer/modules/canvas/canvas2d/canvas_rendering_context_2d_state.cc
[modify] https://crrev.com/b88abf494b5c52e22e54a1318584f1335d41e98c/third_party/blink/renderer/modules/canvas/canvas2d/canvas_rendering_context_2d_state.h

Project Member

Comment 4 by ClusterFuzz, Apr 27 2018

ClusterFuzz has detected this issue as fixed in range 554111:554115.

Detailed report: https://clusterfuzz.com/testcase?key=6567584640794624

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  blink::CanvasRenderingContext2DState::SetLineWidth
  lineWidthAttributeSetter
  blink::V8CanvasRenderingContext2D::lineWidthAttributeSetterCallback
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=552707:552711
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=554111:554115

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6567584640794624

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Apr 27 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6567584640794624 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment