Integer-overflow in glsl::OutputASM::LoopInfo::LoopInfo |
|||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5406912154435584 Fuzzer: libFuzzer_swiftshader_vertex_routine_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: glsl::OutputASM::LoopInfo::LoopInfo glsl::OutputASM::visitLoop TIntermLoop::traverse Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=529739:529747 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5406912154435584 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Jun 7 2018
Automatically adding ccs based on OWNERS file / target commit history. If this is incorrect, please add ClusterFuzz-Wrong label.
,
Jun 8 2018
@sugoi -- Could you please look into this issue. Assigning this issue to you, as per the update we received from you in the Issue 781505 . Please reassign if it is not related to your changes. Thanks. Ref Issue: https://bugs.chromium.org/p/chromium/issues/detail?id=781505#c3 Thanks!
,
Jun 8 2018
Integer overflow is here: https://cs.chromium.org/chromium/src/third_party/swiftshader/src/OpenGL/compiler/OutputASM.cpp?l=3882 Code around it was modified in capn@'s cl here: https://swiftshader-review.googlesource.com/c/SwiftShader/+/18988 Delegating to capn@.
,
Aug 2
This is benign since it just computes a loop unrolling recommendation. Probably won't address this before we replace the compiler with glslang producing SPIR-V.
,
Dec 1
ClusterFuzz testcase 5406912154435584 appears to be flaky, updating reproducibility label.
,
Dec 1
Please ignore the last comment about testcase being unreproducible. The testcase is still reproducible. This happened due to a code refactoring on ClusterFuzz side, and the underlying root cause is now fixed. Resetting the label back to Reproducible. Sorry about the inconvenience caused from these incorrect notifications.
,
Dec 1
Please ignore the last comment about testcase being unreproducible. The testcase is still reproducible. This happened due to a code refactoring on ClusterFuzz side, and the underlying root cause is now fixed. Resetting the label back to Reproducible. Sorry about the inconvenience caused from these incorrect notifications. |
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by ClusterFuzz
, Jun 7 2018Labels: Test-Predator-Auto-Components