-
Notifications
You must be signed in to change notification settings - Fork 8
/
Copy path10305.json
158 lines (158 loc) · 15.3 KB
/
10305.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
{
"fix": "https://skia.googlesource.com/skia.git/+/f19e3f48b5fb00432adc80055d4f820837f35398%5E%21/",
"verify": "0",
"localId": 10305,
"project": "skia",
"fuzzer": "libfuzzer",
"sanitizer": "msan",
"crash_type": "Use-of-uninitialized-value",
"severity": "Medium",
"report": {
"comments": [
{
"projectName": "oss-fuzz",
"localId": 10305,
"commenter": {
"userId": "382749006",
"displayName": "ClusterFuzz-External"
},
"timestamp": 1536721882,
"content": "Detailed report: https://oss-fuzz.com/testcase?key=5671296839450624\n\nProject: skia\nFuzzer: libFuzzer_skia_textblob_deserialize\nFuzz target binary: textblob_deserialize\nJob Type: libfuzzer_msan_skia\nPlatform Id: linux\n\nCrash Type: Use-of-uninitialized-value\nCrash Address: \nCrash State:\n SkScalarSignAsScalar\n SkColorSpaceTransferFn::operator\n SkColorSpaceXformSteps::apply\n \nSanitizer: memory (MSAN)\n\nRecommended Security Severity: Medium\n\nRegressed: https://oss-fuzz.com/revisions?job=libfuzzer_msan_skia&range=201809070303:201809112131\n\nReproducer Testcase: https://oss-fuzz.com/download?testcase_id=5671296839450624\n\nIssue filed automatically.\n\nSee https://skia.org/dev/testing/fuzz for more information.\n\nThis bug is subject to a 90 day disclosure deadline. If 90 days elapse\nwithout an upstream patch, then the bug report will automatically\nbecome visible to the public.\n\nWhen you fix this bug, please\n * mention the fix revision(s).\n * state whether the bug was a short-lived regression or an old bug in any stable releases.\n * add any other useful information.\nThis information can help downstream consumers.\n\nIf you need to contact the OSS-Fuzz team with a question, concern, or any other feedback, please file an issue at https://github.com/google/oss-fuzz/issues.",
"descriptionNum": 1
},
{
"projectName": "oss-fuzz",
"localId": 10305,
"sequenceNum": 1,
"commenter": {
"userId": "382749006",
"displayName": "ClusterFuzz-External"
},
"timestamp": 1536722946,
"amendments": [
{
"fieldName": "Labels",
"newOrDeltaValue": "OS-Linux"
}
]
},
{
"projectName": "oss-fuzz",
"localId": 10305,
"sequenceNum": 2,
"commenter": {
"userId": "2195585128",
"displayName": "[email protected]"
},
"timestamp": 1537188015,
"content": "==214414==WARNING: MemorySanitizer: use-of-uninitialized-value\r\n #0 0x1669ecd in SkColorSpaceTransferFn::operator()(float) const /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../include/core/SkColorSpace.h:78:13\r\n #1 0x16697ad in SkColorSpaceXformSteps::apply(float*) const /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/core/SkColorSpaceXformSteps.cpp:104:19\r\n #2 0x1af6a5d in to_skcolor(SkColor4f, SkColorSpace*) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/shaders/SkColorShader.cpp:111:11\r\n #3 0x1af67f3 in SkColor4Shader::SkColor4Shader(SkColor4f const&, sk_sp<SkColorSpace>) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/shaders/SkColorShader.cpp:120:24\r\n #4 0x1af8b85 in sk_sp<SkColor4Shader> sk_make_sp<SkColor4Shader, SkColor4f const&, sk_sp<SkColorSpace> >(SkColor4f const&, sk_sp<SkColorSpace>&&) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../include/core/SkRefCnt.h:406:25\r\n #5 0x1af7230 in SkShader::MakeColorShader(SkColor4f const&, sk_sp<SkColorSpace>) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/shaders/SkColorShader.cpp:235:12\r\n #6 0x1e40561 in SkGradientShader::MakeRadial(SkPoint const&, float, SkColor4f const*, sk_sp<SkColorSpace>, float const*, int, SkShader::TileMode, unsigned int, SkMatrix const*) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/shaders/gradients/SkGradientShader.cpp:669:16\r\n #7 0x1e67476 in SkRadialGradient::CreateProc(SkReadBuffer&) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/shaders/gradients/SkRadialGradient.cpp:51:12\r\n #8 0x1939300 in SkReadBuffer::readFlattenable(SkFlattenable::Type) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/core/SkReadBuffer.cpp:449:15\r\n #9 0x1866b79 in sk_sp<SkPathEffect> SkReadBuffer::readFlattenable<SkPathEffect>() /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/core/SkReadBuffer.h:154:35\r\n #10 0x18640ed in SkReadBuffer::readPathEffect() /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/core/SkReadBuffer.h:160:57\r\n #11 0x18638e2 in SkPaintPriv::Unflatten(SkPaint*, SkReadBuffer&) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/core/SkPaint.cpp:1265:37\r\n #12 0x1a99471 in SkTextBlobPriv::MakeFromBuffer(SkReadBuffer&) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/core/SkTextBlob.cpp:851:16\r\n #13 0x13a4c85 in FuzzTextBlobDeserialize(SkReadBuffer&) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../fuzz/oss_fuzz/FuzzTextBlobDeserialize.cpp:15:15\r\n #14 0x134d21a in fuzz_textblob_deserialize(sk_sp<SkData>) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../fuzz/fuzz.cpp:657:5\r\n #15 0x1346494 in fuzz_file(SkString, SkString) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../fuzz/fuzz.cpp:203:9\r\n #16 0x1345340 in main /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../fuzz/fuzz.cpp:109:16\r\n #17 0x7f534bda42b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)\r\n #18 0x1292029 in _start (/usr/local/google/home/kjlubick/skia/skia/out/MSAN/fuzz+0x1292029)\r\n\r\n Uninitialized value was stored to memory at\r\n #0 0x1669642 in SkColorSpaceXformSteps::apply(float*) const /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/core/SkColorSpaceXformSteps.cpp:98:21\r\n #1 0x1af6a5d in to_skcolor(SkColor4f, SkColorSpace*) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/shaders/SkColorShader.cpp:111:11\r\n #2 0x1af67f3 in SkColor4Shader::SkColor4Shader(SkColor4f const&, sk_sp<SkColorSpace>) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/shaders/SkColorShader.cpp:120:24\r\n #3 0x1af8b85 in sk_sp<SkColor4Shader> sk_make_sp<SkColor4Shader, SkColor4f const&, sk_sp<SkColorSpace> >(SkColor4f const&, sk_sp<SkColorSpace>&&) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../include/core/SkRefCnt.h:406:25\r\n #4 0x1af7230 in SkShader::MakeColorShader(SkColor4f const&, sk_sp<SkColorSpace>) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/shaders/SkColorShader.cpp:235:12\r\n #5 0x1e40561 in SkGradientShader::MakeRadial(SkPoint const&, float, SkColor4f const*, sk_sp<SkColorSpace>, float const*, int, SkShader::TileMode, unsigned int, SkMatrix const*) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/shaders/gradients/SkGradientShader.cpp:669:16\r\n #6 0x1e67476 in SkRadialGradient::CreateProc(SkReadBuffer&) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/shaders/gradients/SkRadialGradient.cpp:51:12\r\n #7 0x1939300 in SkReadBuffer::readFlattenable(SkFlattenable::Type) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/core/SkReadBuffer.cpp:449:15\r\n #8 0x1866b79 in sk_sp<SkPathEffect> SkReadBuffer::readFlattenable<SkPathEffect>() /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/core/SkReadBuffer.h:154:35\r\n #9 0x18640ed in SkReadBuffer::readPathEffect() /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/core/SkReadBuffer.h:160:57\r\n #10 0x18638e2 in SkPaintPriv::Unflatten(SkPaint*, SkReadBuffer&) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/core/SkPaint.cpp:1265:37\r\n #11 0x1a99471 in SkTextBlobPriv::MakeFromBuffer(SkReadBuffer&) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/core/SkTextBlob.cpp:851:16\r\n #12 0x13a4c85 in FuzzTextBlobDeserialize(SkReadBuffer&) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../fuzz/oss_fuzz/FuzzTextBlobDeserialize.cpp:15:15\r\n #13 0x134d21a in fuzz_textblob_deserialize(sk_sp<SkData>) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../fuzz/fuzz.cpp:657:5\r\n #14 0x1346494 in fuzz_file(SkString, SkString) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../fuzz/fuzz.cpp:203:9\r\n #15 0x1345340 in main /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../fuzz/fuzz.cpp:109:16\r\n #16 0x7f534bda42b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)\r\n\r\n Uninitialized value was created by an allocation of 'steps' in the stack frame of function '_ZL10to_skcolor9SkColor4fP12SkColorSpace'\r\n #0 0x1af6860 in to_skcolor(SkColor4f, SkColorSpace*) /usr/local/google/home/kjlubick/skia/skia/out/MSAN/../../src/shaders/SkColorShader.cpp:108\r\n\r\n Do note that since we require skia_enable_gpu=true to build our tools (including fuzz), one will need to do the following after an MSAN build to avoid issues when it tries to connect to the non-instrumented GPU things.\r\n\r\npatchelf --remove-needed libX11.so.6 out/MSAN/fuzz \r\npatchelf --remove-needed libGLU.so.1 out/MSAN/fuzz \r\npatchelf --remove-needed libGL.so.1 out/MSAN/fuzz",
"amendments": [
{
"fieldName": "Owner",
"newOrDeltaValue": "[email protected]"
}
]
},
{
"projectName": "oss-fuzz",
"localId": 10305,
"sequenceNum": 3,
"commenter": {
"userId": "13190462",
"displayName": "[email protected]"
},
"timestamp": 1537207197,
"content": "Pretty sure this is https://skia.googlesource.com/skia/+/58aa824ddaea7a37632545e27bee342361b1a9d7",
"amendments": [
{
"fieldName": "Owner",
"newOrDeltaValue": "a_deleted_user"
},
{
"fieldName": "Cc",
"newOrDeltaValue": "-a_deleted_user [email protected] a_deleted_user"
}
]
},
{
"projectName": "oss-fuzz",
"localId": 10305,
"sequenceNum": 4,
"commenter": {
"userId": "382749006",
"displayName": "ClusterFuzz-External"
},
"timestamp": 1537207415,
"amendments": [
{
"fieldName": "Cc",
"newOrDeltaValue": "-a_deleted_user a_deleted_user"
}
]
},
{
"projectName": "oss-fuzz",
"localId": 10305,
"sequenceNum": 5,
"commenter": {
"userId": "3275348242",
"displayName": "[email protected]"
},
"timestamp": 1537225183,
"content": "The following revision refers to this bug:\n https://skia.googlesource.com/skia/+/f19e3f48b5fb00432adc80055d4f820837f35398\n\ncommit f19e3f48b5fb00432adc80055d4f820837f35398\nAuthor: Mike Klein <[email protected]>\nDate: Mon Sep 17 22:59:39 2018\n\nsimplify src->dst matrix init\n\nsrc->toXYZD50() and dst->fromXYZD5() always work now.\n\nAnd if they've somehow got a non-3x3 matrix, fine... we'll just handle\nit wrong. It's better to initialize the src->dst 3x3 with what we've\ngot and ignore the outer row and column than to leave it uninitialized\nor zero or identity.\n\nBug: oss-fuzz:10305\n\nChange-Id: I1904a4e297758412a1cc442e88a45b5ec2be9fb5\nReviewed-on: https://skia-review.googlesource.com/154867\nAuto-Submit: Mike Klein <[email protected]>\nReviewed-by: Brian Osman <[email protected]>\nCommit-Queue: Brian Osman <[email protected]>\n\n[modify] https://crrev.com/f19e3f48b5fb00432adc80055d4f820837f35398/src/core/SkColorSpaceXformSteps.cpp\n"
},
{
"projectName": "oss-fuzz",
"localId": 10305,
"sequenceNum": 6,
"commenter": {
"userId": "382749006",
"displayName": "ClusterFuzz-External"
},
"timestamp": 1537255091,
"content": "ClusterFuzz has detected this issue as fixed in range 201809170315:201809180326.\n\nDetailed report: https://oss-fuzz.com/testcase?key=5671296839450624\n\nProject: skia\nFuzzer: libFuzzer_skia_textblob_deserialize\nFuzz target binary: textblob_deserialize\nJob Type: libfuzzer_msan_skia\nPlatform Id: linux\n\nCrash Type: Use-of-uninitialized-value\nCrash Address: \nCrash State:\n SkScalarSignAsScalar\n SkColorSpaceTransferFn::operator\n SkColorSpaceXformSteps::apply\n \nSanitizer: memory (MSAN)\n\nRecommended Security Severity: Medium\n\nRegressed: https://oss-fuzz.com/revisions?job=libfuzzer_msan_skia&range=201809070303:201809112131\nFixed: https://oss-fuzz.com/revisions?job=libfuzzer_msan_skia&range=201809170315:201809180326\n\nReproducer Testcase: https://oss-fuzz.com/download?testcase_id=5671296839450624\n\nSee https://skia.org/dev/testing/fuzz for more information.\n\nIf you suspect that the result above is incorrect, try re-doing that job on the test case report page."
},
{
"projectName": "oss-fuzz",
"localId": 10305,
"sequenceNum": 7,
"commenter": {
"userId": "382749006",
"displayName": "ClusterFuzz-External"
},
"timestamp": 1537255567,
"content": "ClusterFuzz testcase 5671296839450624 is verified as fixed, so closing issue as verified.\n\nIf this is incorrect, please file a bug on https://github.com/google/oss-fuzz/issues/new",
"amendments": [
{
"fieldName": "Status",
"newOrDeltaValue": "Verified",
"oldValue": "New"
},
{
"fieldName": "Labels",
"newOrDeltaValue": "ClusterFuzz-Verified"
}
]
},
{
"projectName": "oss-fuzz",
"localId": 10305,
"sequenceNum": 8,
"commenter": {
"userId": "4164592774",
"displayName": "[email protected]"
},
"timestamp": 1539876336,
"content": "This bug has been fixed for 30 days. It has been opened to the public.\n\n- Your friendly Sheriffbot",
"amendments": [
{
"fieldName": "Labels",
"newOrDeltaValue": "-restrict-view-commit"
}
]
}
]
},
"fix_commit": "f19e3f48b5fb00432adc80055d4f820837f35398",
"repo_addr": "https://skia.googlesource.com/skia.git"
}