Integer-overflow in SkCanvas::internalDrawDevice |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5721416077672448 Fuzzer: libFuzzer_paint_op_buffer_eq_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: SkCanvas::internalDrawDevice SkCanvas::internalRestore SkCanvas::restore Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=601211:601224 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5721416077672448 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Oct 25
Automatically adding ccs based on OWNERS file / target commit history. If this is incorrect, please add ClusterFuzz-Wrong label.
,
Oct 25
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/cf4ceef1f39ff2085106bd534668fc35426f79fc (Introduce a new PaintOp for Skottie). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Oct 26
I don't think this is related to this patch. Its an integer overflow in skia for a different op:
../../third_party/skia/src/core/SkCanvas.cpp:1226:28: runtime error: signed integer overflow: -2147483520 - 130 cannot be represented in type 'int'
precisely here: SkIPoint pos = { x - iter.getX(), y - iter.getY() };
+fmalita, maybe we should use SkSafeMath here?
,
Nov 17
ClusterFuzz has detected this issue as fixed in range 608840:608859. Detailed report: https://clusterfuzz.com/testcase?key=5721416077672448 Fuzzer: libFuzzer_paint_op_buffer_eq_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Integer-overflow Crash Address: Crash State: SkCanvas::internalDrawDevice SkCanvas::internalRestore SkCanvas::restore Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=601211:601224 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=608840:608859 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5721416077672448 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 17
ClusterFuzz testcase 5721416077672448 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, Oct 25Labels: Test-Predator-Auto-Components