Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(138)

Issue 107003006: Fixing crash found by fuzzer (Closed)

Created:
7 years ago by sugoi1
Modified:
6 years, 11 months ago
Reviewers:
mtklein, bsalomon, sugoi, reed1
CC:
skia-review_googlegroups.com
Base URL:
https://skia.googlesource.com/skia.git@master
Visibility:
Public.

Description

Fixing crash found by fuzzer A previous fix only partially fixed this issue by adding validation on some inputs of SkImageInfo. If anything invalid is detected in SkImageInfo, unfortunately, this can cause getSafeSize() to do an illegal memory access while calling bytesPerPixel(), which could have a bad color type at this point. A possible fix is to simply make sure we are in a valid state before calling getSafeSize(). BUG=329254 Committed: http://code.google.com/p/skia/source/detail?r=12844

Patch Set 1 #

Unified diffs Side-by-side diffs Delta from patch set Stats (+1 line, -1 line) Patch
M src/core/SkMallocPixelRef.cpp View 1 chunk +1 line, -1 line 0 comments Download

Messages

Total messages: 6 (0 generated)
sugoi
7 years ago (2013-12-20 18:12:18 UTC) #1
sugoi
I'm going away for 2 weeks now, so if by any chance anyone approves this ...
7 years ago (2013-12-20 21:13:08 UTC) #2
reed1
lgtm
6 years, 11 months ago (2013-12-30 15:24:42 UTC) #3
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://skia-tree-status.appspot.com/cq/sugoi@chromium.org/107003006/1
6 years, 11 months ago (2013-12-30 15:24:54 UTC) #4
reed1
we need to start finding ways to inject badness, so we can reproducibly exercise these ...
6 years, 11 months ago (2013-12-30 15:25:44 UTC) #5
commit-bot: I haz the power
6 years, 11 months ago (2013-12-30 15:48:12 UTC) #6
Message was sent while issue was closed.
Change committed as 12844

Powered by Google App Engine
This is Rietveld 408576698