New issue
Advanced search Search tips

Issue 842491 link

Starred by 2 users

Issue metadata

Status: Duplicate
Merged: issue 874402
Owner:
Closed: Nov 20
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: *length < bufsize in gles2_cmd_decoder_passthrough.h

Project Member Reported by ClusterFuzz, May 13 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6180024408080384

Fuzzer: libFuzzer_gpu_angle_passthrough_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  *length < bufsize in gles2_cmd_decoder_passthrough.h
  gpu::error::Error gpu::gles2::GLES2DecoderPassthroughImpl::GetNumericHelper<long
  gpu::gles2::GLES2DecoderPassthroughImpl::DoGetInteger64v
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=523270:523295

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6180024408080384

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, May 13 2018

Components: Internals>GPU>Internals
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, May 13 2018

Cc: piman@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 3 by ClusterFuzz, May 13 2018

Cc: hubbe@google.com ericrk@chromium.org
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Make r16_ext textures work with validating decoder. by hubbe@google.com - https://chromium.googlesource.com/chromium/src/+/37924baf9ac8f3ce7811508bc650efe965bb50b2

Revert "Logging to ensure that non-offscreen surfaces are destroyed as expected" by ericrk@chromium.org - https://chromium.googlesource.com/chromium/src/+/7b9fe37fc214c456257f79ff6e9c76d37657100d

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.

Comment 4 by piman@chromium.org, May 14 2018

Owner: geoffl...@chromium.org
Project Member

Comment 5 by ClusterFuzz, May 17 2018

ClusterFuzz has detected this issue as fixed in range 559059:559067.

Detailed report: https://clusterfuzz.com/testcase?key=6180024408080384

Fuzzer: libFuzzer_gpu_angle_passthrough_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  *length < bufsize in gles2_cmd_decoder_passthrough.h
  gpu::error::Error gpu::gles2::GLES2DecoderPassthroughImpl::GetNumericHelper<long
  gpu::gles2::GLES2DecoderPassthroughImpl::DoGetInteger64v
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=523270:523295
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=559059:559067

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6180024408080384

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, May 17 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Untriaged)
ClusterFuzz testcase 6180024408080384 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Comment 7 by piman@chromium.org, May 17 2018

Cc: backer@chromium.org
Labels: ClusterFuzz-Wrong
Status: Assigned (was: Verified)
https://chromium.googlesource.com/chromium/src/+/a210e801d2389b72e762a446be8651700a71b330 (in the progression range) landed which changes the interpretation of the "config" bits, causing the repro cases to not apply any more (we temporarily lost coverage). CF would eventually restore coverage, but in the mean time let's reopen.
Mergedinto: 874402
Status: Duplicate (was: Assigned)

Sign in to add a comment