Closed
Bug 1850064
Opened 2 years ago
Closed 2 years ago
AddressSanitizer: heap-buffer-overflow [@ mozilla::gfx::PathOps::StreamToSink] with READ of size 4
Categories
(Core :: Graphics: WebRender, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 1846685
| Tracking | Status | |
|---|---|---|
| firefox118 | --- | affected |
People
(Reporter: truber, Unassigned)
References
(Blocks 1 open bug)
Details
(Keywords: crash, pernosco, testcase, Whiteboard: [fuzzblocker])
Attachments
(3 files)
The attached testcase crashes on mozilla-central revision 20230824-014c9a0ccc44 (build with --enable-fuzzing & moz2d target patch).
For detailed crash information, see attachment.
To reproduce the issue:
- Build an ASan
--enable-fuzzingbuild including gtests with https://phabricator.services.mozilla.com/D186833 applied. - Run
FUZZER=Moz2D objdir/dist/bin/firefox test.bin
|
Reporter | |
Comment 1•2 years ago
|
||
|
|
Reporter | |
Comment 2•2 years ago
|
||
|
|
Reporter | |
Comment 3•2 years ago
|
||
Decoded test.bin call.
|
||
Comment 4•2 years ago
|
||
A Pernosco session is available here: https://pernos.co/debug/E7orJn-Nr_oE07n2vcl60A/index.html
Keywords: pernosco
|
|
||
Comment 5•2 years ago
|
||
This issue is triggered within seconds of launching the fuzzer. Marking as fuzzblocker.
Whiteboard: [fuzzblocker]
|
||
Updated•2 years ago
|
Blocks: gfx-triage
|
||
Updated•2 years ago
|
|
|
||
Updated•1 year ago
|
Group: gfx-core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•