Null-dereference READ in dawn_native::ObjectBase::GetDevice |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6222361101336576 Fuzzer: libFuzzer_dawn_wire_server_and_frontend_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000010 Crash State: dawn_native::ObjectBase::GetDevice dawn_native::BufferBase::MapReadAsync dawn_native::ValidatingBufferMapReadAsync Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=607416:607428 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6222361101336576 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Nov 14
,
Nov 19
,
Nov 20
The following revision refers to this bug: https://dawn.googlesource.com/dawn/+/c56860e27fb3390a955ecc4ba5c8895b403046cb commit c56860e27fb3390a955ecc4ba5c8895b403046cb Author: Corentin Wallez <cwallez@chromium.org> Date: Tue Nov 20 09:31:45 2018 WireServer: Check for ID 0 in hand-written handlers. BUG= chromium:905272 Change-Id: Ib8efb307dbdd6fc57d2cc75366f238c4dfb2beea Reviewed-on: https://dawn-review.googlesource.com/c/2563 Reviewed-by: Kai Ninomiya <kainino@chromium.org> Reviewed-by: Stephen White <senorblanco@chromium.org> Reviewed-by: Corentin Wallez <cwallez@chromium.org> Commit-Queue: Corentin Wallez <cwallez@chromium.org> [modify] https://crrev.com/c56860e27fb3390a955ecc4ba5c8895b403046cb/generator/templates/dawn_wire/WireServer.cpp
,
Nov 21
ClusterFuzz has detected this issue as fixed in range 609745:609746. Detailed report: https://clusterfuzz.com/testcase?key=6222361101336576 Fuzzer: libFuzzer_dawn_wire_server_and_frontend_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000010 Crash State: dawn_native::ObjectBase::GetDevice dawn_native::BufferBase::MapReadAsync dawn_native::ValidatingBufferMapReadAsync Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=607416:607428 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=609745:609746 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6222361101336576 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 21
ClusterFuzz testcase 6222361101336576 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by ClusterFuzz
, Nov 14Labels: ClusterFuzz-Auto-CC