This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

assining to ccameron@chromium.org based on regression range and candidate CL https://chromium-review.googlesource.com/1083782

Please revert or fix quickly.

It appears SwiftShader's Blitter is missing support for clearing FP16 image formats (and ends up attempting to copy multiple pixels from a 1x1 image instead). We actually use FP32 buffers for them internally, for which we do support clearing so we typically don't run into issues, but in this case the external buffer was 'dirty' so we try to clear that one directly instead.

Fix coming soon...

The NextAction date has arrived: 2018-06-15

This might be the same as  Issue 851707 . That one has a stack trace for the SwiftShader libraries though. @sebmarchand do you happen to know why we're not getting stack trace symbols in this one? Interestingly the detailed clusterfuzz report does tell us that the stack-buffer-overflow happened between the 'rgba' and 'clearRect' local variables. So at least some symbols are available.

Fix is going through testing now: https://swiftshader-review.googlesource.com/19448

Hum, this is weird, the log says "Failed to initialize DbgHelp", so here's a few hypothesis:
- We switched to a new Win SDK and there's some incompatibilities between this version of the SDK and the copy of dbghelp we're using?
- This is because of the switch to LLD.

Adding Hans and Bruce to see if they have a better idea of what might be going on here.

+inferno@ : Where are these builds coming from? 

The following revision refers to this bug:
  https://swiftshader.googlesource.com/SwiftShader.git/+/700a1a67d569fd5a4960ec36fce9c35d2b59aca2

commit 700a1a67d569fd5a4960ec36fce9c35d2b59aca2
Author: Nicolas Capens <capn@google.com>
Date: Fri Jun 15 17:33:47 2018

Fix clearing of dirty textures.

When clear operations fall back to the slow path (i.e. neither fastClear
nor blitReactor is used), we were copying a rectangle the size of the
destination image. It should only sample within the 1x1 source pixel
instead.

 Bug chromium:852641 ,  chromium:851707 

Change-Id: I9f247483f6167f92be8308b8470c021f5641b657
Reviewed-on: https://swiftshader-review.googlesource.com/19448
Reviewed-by: Alexis Hétu <sugoi@google.com>
Tested-by: Nicolas Capens <nicolascapens@google.com>

[modify] https://crrev.com/700a1a67d569fd5a4960ec36fce9c35d2b59aca2/src/Renderer/Blitter.cpp
[modify] https://crrev.com/700a1a67d569fd5a4960ec36fce9c35d2b59aca2/src/Renderer/Surface.cpp
[modify] https://crrev.com/700a1a67d569fd5a4960ec36fce9c35d2b59aca2/tests/unittests/unittests.cpp

> the log says "Failed to initialize DbgHelp"

We hit some problems, fixed last week, with just such an incompatibility. I respun the SDK toolchain to fix it. You might be hitting a variant of the same problem if you are pulling dbghelp.dll from a different source from the EXEs which depend on it. The safest thing to do is to copy binaries from the winsdk\debuggers folder in the toolchain.

But, looking into that error message it sounds like that happens when DbgHelp has been previously used in the same process, so it's probably a totally different issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/083b6f261561e534a5f68c6477cef6c0b64ea710

commit 083b6f261561e534a5f68c6477cef6c0b64ea710
Author: Nicolas Capens <capn@chromium.org>
Date: Sat Jun 16 15:51:53 2018

Roll SwiftShader 88482c3..700a1a6

https://swiftshader.googlesource.com/SwiftShader.git/+log/88482c3..700a1a6

BUG= chromium:845700 ,  chromium:852641 ,  chromium:851707 

TBR=kbr@chromium.org

TEST=bots

CQ_INCLUDE_TRYBOTS=luci.chromium.try:win_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_chromium_cfi_rel_ng;luci.chromium.try:android_optional_gpu_tests_rel

Change-Id: Ic36ddc1988cd83970a4a53b52a1ce1b229d17137
Reviewed-on: https://chromium-review.googlesource.com/1102886
Commit-Queue: Nicolas Capens <capn@chromium.org>
Reviewed-by: Alexis Hétu <sugoi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#567894}
[modify] https://crrev.com/083b6f261561e534a5f68c6477cef6c0b64ea710/DEPS

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f3a2fd4ce7fefe8dea3c5607982856f91c69ec8c

commit f3a2fd4ce7fefe8dea3c5607982856f91c69ec8c
Author: Dirk Pranke <dpranke@chromium.org>
Date: Sat Jun 16 21:30:31 2018

Revert "Roll SwiftShader 88482c3..700a1a6"

This reverts commit 083b6f261561e534a5f68c6477cef6c0b64ea710.

Reason for revert: I think this is causing crashes on Mac 10.13 (dbg). See https://ci.chromium.org/p/chromium/builders/luci.chromium.ci/Mac10.13%20Tests%20%28dbg%29/3362.

Original change's description:
> Roll SwiftShader 88482c3..700a1a6
> 
> https://swiftshader.googlesource.com/SwiftShader.git/+log/88482c3..700a1a6
> 
> BUG= chromium:845700 ,  chromium:852641 ,  chromium:851707 
> 
> TBR=kbr@chromium.org
> 
> TEST=bots
> 
> CQ_INCLUDE_TRYBOTS=luci.chromium.try:win_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_chromium_cfi_rel_ng;luci.chromium.try:android_optional_gpu_tests_rel
> 
> Change-Id: Ic36ddc1988cd83970a4a53b52a1ce1b229d17137
> Reviewed-on: https://chromium-review.googlesource.com/1102886
> Commit-Queue: Nicolas Capens <capn@chromium.org>
> Reviewed-by: Alexis Hétu <sugoi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#567894}

TBR=sugoi@chromium.org,capn@chromium.org

Change-Id: I96e96329f4de1581ca11fca443fa943e58ce8f4c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  chromium:845700 ,  chromium:852641 ,  chromium:851707 
Cq-Include-Trybots: luci.chromium.try:win_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_chromium_cfi_rel_ng;luci.chromium.try:android_optional_gpu_tests_rel
Reviewed-on: https://chromium-review.googlesource.com/1103398
Reviewed-by: Dirk Pranke <dpranke@chromium.org>
Commit-Queue: Dirk Pranke <dpranke@chromium.org>
Cr-Commit-Position: refs/heads/master@{#567898}
[modify] https://crrev.com/f3a2fd4ce7fefe8dea3c5607982856f91c69ec8c/DEPS

on ClusterFuzz, We were just installing the win10 sdk from 2017, let me try updating bots to latest version of win10sdk from https://developer.microsoft.com/en-us/windows/downloads/windows-10-sdk

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/efddbaa1da8640c7556477a5040462ddd6f2bb69

commit efddbaa1da8640c7556477a5040462ddd6f2bb69
Author: Alexis Hetu <sugoi@google.com>
Date: Tue Jun 19 01:01:03 2018

Roll SwiftShader 88482c3..1fa2067

https://swiftshader.googlesource.com/SwiftShader.git/+log/88482c3..1fa2067

BUG= chromium:845700   chromium:852641   chromium:851707 

TBR=kbr@chromium.org

TEST=bots

CQ_INCLUDE_TRYBOTS=luci.chromium.try:win_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_chromium_cfi_rel_ng;luci.chromium.try:android_optional_gpu_tests_rel

Change-Id: I86645f0e44657bd864a347728994e469b789bc75
Reviewed-on: https://chromium-review.googlesource.com/1104986
Commit-Queue: Alexis Hétu <sugoi@chromium.org>
Reviewed-by: Alexis Hétu <sugoi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#568271}
[modify] https://crrev.com/efddbaa1da8640c7556477a5040462ddd6f2bb69/DEPS

ClusterFuzz has detected this issue as fixed in range 568270:568271.

Detailed report: https://clusterfuzz.com/testcase?key=6561448084635648

Fuzzer: ochang_domfuzzer
Job Type: windows_asan_content_shell
Platform Id: windows

Crash Type: Stack-buffer-overflow READ 4
Crash Address: 0x0082827db670
Crash State:
  libGLESv2_swiftshader
  libGLESv2_swiftshader
  libGLESv2_swiftshader
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=564323:564324
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=568270:568271

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6561448084635648

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6561448084635648 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot