Integer-overflow in FX_RECT::Width |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5675269227282432 Fuzzer: attekett_surku_fuzzer Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: FX_RECT::Width CFX_RenderDevice::DrawFillStrokePath CFX_RenderDevice::DrawPathWithBlend Sanitizer: undefined (UBSAN) Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5675269227282432 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Jun 18 2018
,
Jun 21 2018
,
Jun 22 2018
The following revision refers to this bug: https://pdfium.googlesource.com/pdfium/+/e6ca7c2d7d45bd59d53c3c6f9952e2001cf81890 commit e6ca7c2d7d45bd59d53c3c6f9952e2001cf81890 Author: Henrique Nakashima <hnakashima@chromium.org> Date: Fri Jun 22 17:10:36 2018 Fix overflow in CFX_RenderDevice::DrawFillStrokePath(). Bug: chromium:853430 Change-Id: I1c42de1e3db10dfb6399cd8abdd13c56addc8827 Reviewed-on: https://pdfium-review.googlesource.com/35850 Reviewed-by: Tom Sepez <tsepez@chromium.org> Reviewed-by: Ryan Harrison <rharrison@chromium.org> Commit-Queue: Henrique Nakashima <hnakashima@chromium.org> [modify] https://crrev.com/e6ca7c2d7d45bd59d53c3c6f9952e2001cf81890/core/fxge/cfx_renderdevice.cpp
,
Jun 22 2018
,
Jun 22 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/db8b814b7d30cb148a3dceccf089a27469b9cb6f commit db8b814b7d30cb148a3dceccf089a27469b9cb6f Author: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Date: Fri Jun 22 20:46:47 2018 Roll src/third_party/pdfium 0a49103801e3..9fff1c76c108 (2 commits) https://pdfium.googlesource.com/pdfium.git/+log/0a49103801e3..9fff1c76c108 git log 0a49103801e3..9fff1c76c108 --date=short --no-merges --format='%ad %ae %s' 2018-06-22 tsepez@chromium.org Avoid some duplicate const/non-const getters. 2018-06-22 hnakashima@chromium.org Fix overflow in CFX_RenderDevice::DrawFillStrokePath(). Created with: gclient setdep -r src/third_party/pdfium@9fff1c76c108 The AutoRoll server is located here: https://pdfium-roll.skia.org Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. BUG= chromium:853430 TBR=dsinclair@chromium.org Change-Id: I80e5560f05738ff3bc26b3d9d6783621908fe281 Reviewed-on: https://chromium-review.googlesource.com/1112218 Reviewed-by: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Commit-Queue: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#569757} [modify] https://crrev.com/db8b814b7d30cb148a3dceccf089a27469b9cb6f/DEPS
,
Jun 24 2018
ClusterFuzz has detected this issue as fixed in range 569753:569759. Detailed report: https://clusterfuzz.com/testcase?key=5675269227282432 Fuzzer: attekett_surku_fuzzer Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: FX_RECT::Width CFX_RenderDevice::DrawFillStrokePath CFX_RenderDevice::DrawPathWithBlend Sanitizer: undefined (UBSAN) Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=569753:569759 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5675269227282432 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jun 24 2018
ClusterFuzz testcase 5675269227282432 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, Jun 16 2018Labels: Test-Predator-Auto-Components