CVE-2026-3538

Critical chrome Integer Overflow 📄 Reporter bug report 🔧 Commit mapped

Overview

Critical

Severity

—

CVSS

Exploited ITW

Fixed

Fix Status

ImpactInteger overflow in Skia

DescriptionInteger overflow in Skia

ComponentSkia

Bug ClassInteger Overflow

Tracker484983991

Fix commit03d405099043 (skia) +39/-2

CISA KEVNot listed

CreditedSymeon Paraschoudis

Disclosed2026-03-03

Changed Functions

Function	Change	Notes
`if` src/gpu/ganesh/GrVertexChunkArray.cpp	modified
`AtlasPathList` src/gpu/ganesh/ops/AtlasRenderTask.h	modified
`if` src/gpu/ganesh/ops/PathTessellateOp.cpp	modified

Files Changed

src/gpu/ganesh/GrVertexChunkArray.cpp
src/gpu/ganesh/ops/AtlasRenderTask.cpp
src/gpu/ganesh/ops/AtlasRenderTask.h
src/gpu/ganesh/ops/PathTessellateOp.cpp
src/gpu/tessellate/FixedCountBufferUtils.h

Patch

view commit

From 03d405099043409a7925e54d7cfad73a9c5ad8db Mon Sep 17 00:00:00 2001
From: Michael Ludwig <michaelludwig@google.com>
Date: Thu, 19 Feb 2026 16:29:16 -0500
Subject: [PATCH] [ganesh] Guard verb counts in tessellation accumulation against overflow

Rejects adding a path if the total verb count would overflow.
Rejects merging ops if their total verb counts would overflow.
Clamps the min allocation size in the GrVertexChunkArray to prevent
overflow.
Clamps the preallocation verb count parameter to avoid overflow in their
intermediate calculations.

Bug: b/484983991
Change-Id: I32359cf10a996baf46b023a6cb8c608834942e0b
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1169977
Commit-Queue: Michael Ludwig <michaelludwig@google.com>
Reviewed-by: Thomas Smith <thomsmit@google.com>
---

diff --git a/src/gpu/ganesh/GrVertexChunkArray.cpp b/src/gpu/ganesh/GrVertexChunkArray.cpp
index 337e394..3d80581 100644
--- a/src/gpu/ganesh/GrVertexChunkArray.cpp
+++ b/src/gpu/ganesh/GrVertexChunkArray.cpp
@@ -10,6 +10,7 @@
 #include "src/gpu/ganesh/GrMeshDrawTarget.h"
 
 #include <algorithm>
+#include <limits>
 
 GrVertexChunkBuilder::~GrVertexChunkBuilder() {
     if (!fChunks->empty()) {
@@ -37,6 +38,12 @@
         fCurrChunkVertexCapacity = 0;
         return false;
     }
-    fMinVerticesPerChunk *= 2;
+
+    int maxVerticesPerChunk = std::numeric_limits<int>::max() / fStride;
+    if (maxVerticesPerChunk / 2 > fMinVerticesPerChunk) {
+        fMinVerticesPerChunk *= 2;
+    } else {
+        fMinVerticesPerChunk = maxVerticesPerChunk;
+    }
     return true;
 }
diff --git a/src/gpu/ganesh/ops/AtlasRenderTask.cpp b/src/gpu/ganesh/ops/AtlasRenderTask.cpp
index 5f05079..13b2ff4 100644
--- a/src/gpu/ganesh/ops/AtlasRenderTask.cpp
+++ b/src/gpu/ganesh/ops/AtlasRenderTask.cpp
@@ -54,6 +54,17 @@
     SkASSERT(this->isEmpty());
     SkASSERT(!fDynamicAtlas->isInstantiated());  // Paths can't be added after instantiate().
 
+    // Check for room in the list first and return false if prior draws need to be flushed first.
+    if (GrFillRuleForSkPath(path) == GrFillRule::kNonzero) {
+        if (!fWindingPathList.canAdd(path)) {
+            return false;
+        }
+    } else {
+        if (!fEvenOddPathList.canAdd(path)) {
+            return false;
+        }
+    }
+
     if (!fDynamicAtlas->addRect(widthInAtlas, heightInAtlas, locationInAtlas)) {
         return false;
     }
diff --git a/src/gpu/ganesh/ops/AtlasRenderTask.h b/src/gpu/ganesh/ops/AtlasRenderTask.h
index c44b426..de056f1 100644
--- a/src/gpu/ganesh/ops/AtlasRenderTask.h
+++ b/src/gpu/ganesh/ops/AtlasRenderTask.h
@@ -22,6 +22,7 @@
 #include "src/gpu/ganesh/ops/OpsTask.h"
 #include "src/gpu/ganesh/tessellate/PathTessellator.h"
 
+#include <limits>
 #include <memory>
 #include <utility>
 
@@ -89,6 +90,7 @@
     class AtlasPathList : SkNoncopyable {
     public:
         void add(PathDrawAllocator* alloc, const SkMatrix& pathMatrix, const SkPath& path) {
+            SkASSERT(this->canAdd(path));
             fPathDrawList = &alloc->emplace_back(pathMatrix, path, SK_PMColor4fTRANSPARENT,
                                                  fPathDrawList);
             if (path.isInverseFillType()) {
@@ -98,6 +100,12 @@
             fTotalCombinedPathVerbCnt += path.countVerbs();
             ++fPathCount;
         }
+
+        bool canAdd(const SkPath& path) const {
+            // Return true so long as we won't overflow the total verb count
+            return std::numeric_limits<int>::max() - fTotalCombinedPathVerbCnt >= path.countVerbs();
+        }
+
         const PathDrawList* pathDrawList() const { return fPathDrawList; }
         int totalCombinedPathVerbCnt() const { return fTotalCombinedPathVerbCnt; }
         int pathCount() const { return fPathCount; }
diff --git a/src/gpu/ganesh/ops/PathTessellateOp.cpp b/src/gpu/ganesh/ops/PathTessellateOp.cpp
index 3bc370f..f879a2e 100644
--- a/src/gpu/ganesh/ops/PathTessellateOp.cpp
+++ b/src/gpu/ganesh/ops/PathTessellateOp.cpp
@@ -5,6 +5,7 @@
  * found in the LICENSE file.
  */
 #include "src/gpu/ganesh/ops/PathTessellateOp.h"
+#include <limits>
 
 #include "include/core/SkColor.h"
 #include "include/gpu/ganesh/GrRecordingContext.h"
@@ -53,10 +54,13 @@
                                                               SkArenaAlloc*,
                                                               const GrCaps&) {
     auto* op = grOp->cast<PathTessellateOp>();
+    bool verbCountOverflow = std::numeric_limits<int>::max() - fTotalCombinedPathVerbCnt <
+            op->fTotalCombinedPathVerbCnt;
     bool canMerge = fAAType == op->fAAType &&
                     fStencil == op->fStencil &&
                     fProcessors == op->fProcessors &&
-                    fShaderMatrix == op->fShaderMatrix;
+                    fShaderMatrix == op->fShaderMatrix &&
+                    !verbCountOverflow;
     if (canMerge) {
         fTotalCombinedPathVerbCnt += op->fTotalCombinedPathVerbCnt;
         fPatchAttribs |= op->fPatchAttribs;
diff --git a/src/gpu/tessellate/FixedCountBufferUtils.h b/src/gpu/tessellate/FixedCountBufferUtils.h
index f2ab0f4..055f6a0 100644
--- a/src/gpu/tessellate/FixedCountBufferUtils.h
+++ b/src/gpu/tessellate/FixedCountBufferUtils.h
@@ -14,6 +14,7 @@
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
+#include <limits>
 
 namespace skgpu { struct VertexWriter; }
 
@@ -44,6 +45,8 @@
         // Over-allocate enough curves for 1 in 4 to chop. Every chop introduces 2 new patches:
         // another curve patch and a triangle patch that glues the two chops together,
         // i.e. + 2 * ((count + 3) / 4) == (count + 3) / 2
+        constexpr int kMaxVerbCount = std::numeric_limits<int>::max() >> 2;
+        totalCombinedPathVerbCnt = std::min(kMaxVerbCount, totalCombinedPathVerbCnt);
         return totalCombinedPathVerbCnt + (totalCombinedPathVerbCnt + 3) / 2;
     }
 
@@ -88,6 +91,8 @@
 
     static constexpr int PreallocCount(int totalCombinedPathVerbCnt)  {
         // Over-allocate enough wedges for 1 in 4 to chop, i.e., ceil(maxWedges * 5/4)
+        constexpr int kMaxVerbCount = std::numeric_limits<int>::max() >> 3;
+        totalCombinedPathVerbCnt = std::min(kMaxVerbCount, totalCombinedPathVerbCnt);
         return (totalCombinedPathVerbCnt * 5 + 3) / 4;
     }
 
@@ -140,6 +145,8 @@
         // Over-allocate enough patches for each stroke to chop once, and for 8 extra caps. Since
         // we have to chop at inflections, points of 180 degree rotation, and anywhere a stroke
         // requires too many parametric segments, many strokes will end up getting choppped.
+        constexpr int kMaxVerbCount = std::numeric_limits<int>::max() >> 2;
+        totalCombinedPathVerbCnt = std::min(kMaxVerbCount, totalCombinedPathVerbCnt);
         return (totalCombinedPathVerbCnt * 2) + 8/* caps */;
     }

Loading diff…

Original Bug Report

reported by si...@gmail.com

Heap-buffer-overflow in Skia PathStencilCoverOp via AtlasPathRenderer integer overflow

Security Bug

Important: Please do not change the component of this bug manually.

VULNERABILITY DETAILS

Component: Skia Ganesh GPU backend — AtlasPathRenderer / PathStencilCoverOp (Canvas 2D fill path)

An integer overflow in AtlasRenderTask::AtlasPathList::add() allows a user to trigger a heap-buffer-overflow write in PathStencilCoverOp::onPrepare() via the HTML Canvas 2D API. The attacker controls the data written past the buffer (path vertex coordinates).

AtlasRenderTask.h:98 accumulates path verb counts with no overflow check:

fTotalCombinedPathVerbCnt += path.countVerbs();  // int32, no overflow check

The atlas only validates path pixel bounds (must fit in 2048x2048), not verb count.

This overflowed count is passed to PathStencilCoverOp (AtlasRenderTask.cpp:120), which uses it to allocate a single contiguous fan triangle buffer (GrEagerDynamicVertexAllocator):

// PathStencilCoverOp.cpp:277-280
int maxTrianglesInFans = std::max(fTotalCombinedPathVerbCnt - 2, 0);
vertexAlloc.lockWriter(sizeof(SkPoint), maxTrianglesInFans * 3);  // undersized!

The fan triangle write loop (PathStencilCoverOp.cpp:281-289) then iterates all actual paths with no runtime bounds checking (VertexWriter::validate() is gated on SK_DEBUG, which is off in official builds):

for (auto [pathMatrix, path, color] : *fPathDrawList) {
    for (tess::PathMiddleOutFanIter it(path); !it.done();) {
        for (auto [p0, p1, p2] : it.nextStack()) {
            triangleVertexWriter << m.map2Points(p0, p1) << m.mapPoint(p2);  // OOB write
        }
    }
}

VERSION Chrome Version: Chrome 147.0.7691.0 ASAN, Windows stable

Operating System: Windows 11 Version 24H2, OS Build 26100.7840

REPRODUCTION CASE

The following flags were used: chrome.exe --disable-gpu-sandbox --enable-gpu-rasterization --disable-features=SkiaGraphite --disable-gpu-watchdog --disable-gpu-driver-bug-workarounds --use-angle=vulkan --user-data-dir="%TEMP%\chrome-test-profile" --no-first-run --no-default-browser-check skia_atlas_overflow_poc.html

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION Type of crash: browser

chrome.exe --disable-gpu-sandbox --enable-gpu-rasterization --disable-features=SkiaGraphite --disable-gpu-watchdog --disable-gpu-driver-bug-workarounds --use-angle=vulkan --user-data-dir="%TEMP%\chrome-test-profile" --no-first-run --no-default-browser-check skia_atlas_overflow_poc.html
=================================================================
==46964==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x11acaa5d1820 at pc 0x7fff153543db bp 0x001237ffd540 sp 0x001237ffd588
WRITE of size 16 at 0x11acaa5d1820 thread T0
    #0 0x7fff153543da in skgpu::BufferWriter::write C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\BufferWriter.h:92
    #1 0x7fff153543da in skgpu::operator<< C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\BufferWriter.h:321
    #2 0x7fff153543da in skgpu::ganesh::PathStencilCoverOp::onPrepare(class GrOpFlushState *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\ops\PathStencilCoverOp.cpp:285:46
    #3 0x7fff15116c04 in GrOp::prepare(class GrOpFlushState *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\ops\GrOp.cpp:59:11
    #4 0x7fff1511e412 in skgpu::ganesh::OpsTask::onPrepare(class GrOpFlushState *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\ops\OpsTask.cpp:548:27
    #5 0x7fff15284653 in GrRenderTask::prepare(class GrOpFlushState *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrRenderTask.cpp:111:11
    #6 0x7fff153ec37a in GrDrawingManager::executeRenderTasks(class GrOpFlushState *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDrawingManager.cpp:266:21
    #7 0x7fff153ea19a in GrDrawingManager::flush(class SkSpan<class GrSurfaceProxy *>, enum SkSurfaces::BackendSurfaceAccess, struct GrFlushInfo const &, class skgpu::MutableTextureState const *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDrawingManager.cpp:209:34
    #8 0x7fff153ed7cd in GrDrawingManager::flushSurfaces(class SkSpan<class GrSurfaceProxy *>, enum SkSurfaces::BackendSurfaceAccess, struct GrFlushInfo const &, class skgpu::MutableTextureState const *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDrawingManager.cpp:540:27
    #9 0x7fff1540584b in GrDirectContextPriv::flushSurfaces(class SkSpan<class GrSurfaceProxy *>, enum SkSurfaces::BackendSurfaceAccess, struct GrFlushInfo const &, class skgpu::MutableTextureState const *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDirectContextPriv.cpp:92:47
    #10 0x7fff1541794a in GrDirectContextPriv::flushSurface C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDirectContextPriv.h:106
    #11 0x7fff1541794a in GrDirectContext::flush(class SkSurface *, struct GrFlushInfo const &, class skgpu::MutableTextureState const *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDirectContext.cpp:520:25
    #12 0x7fff150c88ed in skgpu::ganesh::Flush(class SkSurface *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\surface\SkSurface_Ganesh.cpp:759:45
    #13 0x7fff1937ff06 in gpu::SharedContextState::FlushWriteAccess(class gpu::SkiaImageRepresentation::ScopedWriteAccess *) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\shared_context_state.cc:869:9
    #14 0x7fff19627512 in gpu::raster::RasterDecoderImpl::DoEndRasterCHROMIUM(void) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\raster_decoder.cc:3099:30
    #15 0x7fff19622078 in gpu::raster::RasterDecoderImpl::HandleEndRasterCHROMIUM(unsigned int, void const volatile *) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\raster_decoder_autogen.h:151:3
    #16 0x7fff1962c03d in gpu::raster::RasterDecoderImpl::DoCommandsImpl<0>(unsigned int, void const volatile *, int, int *) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\raster_decoder.cc:1526:18
    #17 0x7fff035de36b in gpu::CommandBufferService::Flush(int, class gpu::AsyncAPIInterface *) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\command_buffer_service.cc:267:35
    #18 0x7fff196e36e1 in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, class std::__Cr::vector<struct gpu::SyncToken, class std::__Cr::allocator<struct gpu::SyncToken>> const &) C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\command_buffer_stub.cc:504:22
    #19 0x7fff196e25f3 in gpu::CommandBufferStub::ExecuteDeferredRequest(class gpu::mojom::DeferredCommandBufferRequestParams &, class gpu::FenceSyncReleaseDelegate *) C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\command_buffer_stub.cc:173:7
    #20 0x7fff196af4a1 in gpu::GpuChannel::ExecuteDeferredRequest(class mojo::StructPtr<class gpu::mojom::DeferredRequestParams>, class gpu::FenceSyncReleaseDelegate *) C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\gpu_channel.cc:833:13
    #21 0x7fff196bf4cf in base::internal::DecayedFunctorTraits<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel> &&,mojo::StructPtr<gpu::mojom::DeferredRequestParams> &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:740
    #22 0x7fff196bf4cf in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel> &&,mojo::StructPtr<gpu::mojom::DeferredRequestParams> &&>,void,0,1>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:956
    #23 0x7fff196bf4cf in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel> &&,mojo::StructPtr<gpu::mojom::DeferredRequestParams> &&>,base::internal::BindState<1,1,0,void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel>,mojo::StructPtr<gpu::mojom::DeferredRequestParams> >,void (gpu::FenceSyncReleaseDelegate *)>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1069
    #24 0x7fff196bf4cf in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl gpu::GpuChannel::*&&)(class mojo::StructPtr<class gpu::mojom::DeferredRequestParams>, class gpu::FenceSyncReleaseDelegate *), class base::WeakPtr<class gpu::GpuChannel> &&, class mojo::StructPtr<class gpu::mojom::DeferredRequestParams> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl gpu::GpuChannel::*)(class mojo::StructPtr<class gpu::mojom::DeferredRequestParams>, class gpu::FenceSyncReleaseDelegate *), class base::WeakPtr<class gpu::GpuChannel>, class mojo::StructPtr<class gpu::mojom::DeferredRequestParams>>, (class gpu::FenceSyncReleaseDelegate *)>::RunOnce(class base::internal::BindStateBase *, class gpu::FenceSyncReleaseDelegate *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:982:12
    #25 0x7fff036204cb in base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:155
    #26 0x7fff036204cb in base::internal::DecayedFunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)>,gpu::FenceSyncReleaseDelegate *>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:815
    #27 0x7fff036204cb in base::internal::InvokeHelper<0,base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)> &&,gpu::FenceSyncReleaseDelegate *>,void,0>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:932
    #28 0x7fff036204cb in base::internal::Invoker<struct base::internal::FunctorTraits<class base::OnceCallback<(class gpu::FenceSyncReleaseDelegate *)> &&, class gpu::FenceSyncReleaseDelegate *>, struct base::internal::BindState<0, 1, 1, class base::OnceCallback<(class gpu::FenceSyncReleaseDelegate *)>, class base::internal::UnretainedWrapper<class gpu::FenceSyncReleaseDelegate, struct base::unretained_traits::MayNotDangle, 0>>, (void)>::RunImpl<class base::OnceCallback<(class gpu::FenceSyncReleaseDelegate *)>, class std::__Cr::tuple<class base::internal::UnretainedWrapper<class gpu::FenceSyncReleaseDelegate, struct base::unretained_traits::MayNotDangle, 0>>, 0>(class base::OnceCallback<(class gpu::FenceSyncReleaseDelegate *)> &&, class std::__Cr::tuple<class base::internal::UnretainedWrapper<class gpu::FenceSyncReleaseDelegate, struct base::unretained_traits::MayNotDangle, 0>> &&, struct std::__Cr::integer_sequence<unsigned __int64, 0>) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1069:14
    #29 0x7fff035f42f2 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:155
    #30 0x7fff035f42f2 in gpu::Scheduler::ExecuteSequence(class base::IdType<class gpu::SyncPointOrderData, unsigned int, 0, 1>) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:707:29
    #31 0x7fff035f2420 in gpu::Scheduler::RunNextTask(void) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:625:3
    #32 0x7fff035f6fa4 in base::internal::DecayedFunctorTraits<void (gpu::Scheduler::*)(),gpu::Scheduler *>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:740
    #33 0x7fff035f6fa4 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (gpu::Scheduler::*&&)(),gpu::Scheduler *>,void,0>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:932
    #34 0x7fff035f6fa4 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::Scheduler::*&&)(),gpu::Scheduler *>,base::internal::BindState<1,1,0,void (gpu::Scheduler::*)(),base::internal::UnretainedWrapper<gpu::Scheduler,base::unretained_traits::MayNotDangle,0> >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1069
    #35 0x7fff035f6fa4 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl gpu::Scheduler::*&&)(void), class gpu::Scheduler *>, struct base::internal::BindState<1, 1, 0, void (__cdecl gpu::Scheduler::*)(void), class base::internal::UnretainedWrapper<class gpu::Scheduler, struct base::unretained_traits::MayNotDangle, 0>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:982:12
    #36 0x7fff1434a988 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:155
    #37 0x7fff1434a988 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:229:34
    #38 0x7fff1431add1 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:112
    #39 0x7fff1431add1 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:475:23
    #40 0x7fff14319c33 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:346:40
    #41 0x7fff14484b10 in base::MessagePumpDefault::Run(class base::MessagePump::Delegate *) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:42:55
    #42 0x7fff1431cb1f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, class base::TimeDelta) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:650:12
    #43 0x7fff143c25ac in base::RunLoop::Run(class base::Location const &) C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:135:14
    #44 0x7fff1deb4f03 in content::GpuMain(struct content::MainFunctionParams) C:\b\s\w\ir\cache\builder\src\content\gpu\gpu_main.cc:479:14
    #45 0x7fff0ff97536 in content::RunOtherNamedProcessTypeMain(class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::__Cr::allocator<char>> const &, struct content::MainFunctionParams, class content::ContentMainDelegate *) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:762:14
    #46 0x7fff0ff99bcb in content::ContentMainRunnerImpl::Run(void) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1147:10
    #47 0x7fff0ff8da9f in content::RunContentProcess(struct content::ContentMainParams, class content::ContentMainRunner *) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:358:36
    #48 0x7fff0ff8e242 in content::ContentMain(struct content::ContentMainParams) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:371:10
    #49 0x7ffefff02b06 in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:191:12
    #50 0x7ff7bac44807 in MainDllLoader::Launch(struct HINSTANCE__*, class base::TimeTicks) C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:204:12
    #51 0x7ff7bac42074 in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:351:20
    #52 0x7ff7bb13c83f in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
    #53 0x7ff7bb13c83f in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #54 0x7ff84e4be8d6  (C:\Windows\System32\KERNEL32.DLL+0x18002e8d6)
    #55 0x7ff84f06c40b  (C:\Windows\SYSTEM32\ntdll.dll+0x18008c40b)

0x11acaa5d1820 is located 0 bytes after 1572896-byte region [0x11acaa451800,0x11acaa5d1820)
allocated by thread T0 here:
    #0 0x7fff6924e51f  (C:\Users\symeon\Desktop\chromium-147.0.7691.0-win64-asan\clang_rt.asan_dynamic-x86_64.dll+0x18005e51f)
    #1 0x7fff15436d32 in GrCpuBuffer::Make C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrCpuBuffer.h:29
    #2 0x7fff15436d32 in GrBufferAllocPool::CpuBufferCache::makeBuffer(unsigned __int64, bool) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrBufferAllocPool.cpp:56:30
    #3 0x7fff15437fc7 in GrBufferAllocPool::resetCpuData(unsigned __int64) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrBufferAllocPool.cpp:389:60
    #4 0x7fff15439cd1 in GrBufferAllocPool::createBlock(unsigned __int64) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrBufferAllocPool.cpp:362:15
    #5 0x7fff15438fce in GrBufferAllocPool::makeSpace(unsigned __int64, unsigned __int64, class sk_sp<class GrBuffer const> *, unsigned __int64 *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrBufferAllocPool.cpp:229:16
    #6 0x7fff1543b8c0 in GrVertexBufferAllocPool::makeSpace(unsigned __int64, int, class sk_sp<class GrBuffer const> *, int *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrBufferAllocPool.cpp:445:28
    #7 0x7fff15349b27 in GrEagerDynamicVertexAllocator::lock(unsigned __int64, int) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrEagerVertexAllocator.cpp:20:31
    #8 0x7fff153528b8 in GrEagerVertexAllocator::lockWriter C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrEagerVertexAllocator.h:39
    #9 0x7fff153528b8 in skgpu::ganesh::PathStencilCoverOp::onPrepare(class GrOpFlushState *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\ops\PathStencilCoverOp.cpp:280:33
    #10 0x7fff15116c04 in GrOp::prepare(class GrOpFlushState *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\ops\GrOp.cpp:59:11
    #11 0x7fff1511e412 in skgpu::ganesh::OpsTask::onPrepare(class GrOpFlushState *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\ops\OpsTask.cpp:548:27
    #12 0x7fff15284653 in GrRenderTask::prepare(class GrOpFlushState *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrRenderTask.cpp:111:11
    #13 0x7fff153ec37a in GrDrawingManager::executeRenderTasks(class GrOpFlushState *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDrawingManager.cpp:266:21
    #14 0x7fff153ea19a in GrDrawingManager::flush(class SkSpan<class GrSurfaceProxy *>, enum SkSurfaces::BackendSurfaceAccess, struct GrFlushInfo const &, class skgpu::MutableTextureState const *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDrawingManager.cpp:209:34
    #15 0x7fff153ed7cd in GrDrawingManager::flushSurfaces(class SkSpan<class GrSurfaceProxy *>, enum SkSurfaces::BackendSurfaceAccess, struct GrFlushInfo const &, class skgpu::MutableTextureState const *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDrawingManager.cpp:540:27
    #16 0x7fff1540584b in GrDirectContextPriv::flushSurfaces(class SkSpan<class GrSurfaceProxy *>, enum SkSurfaces::BackendSurfaceAccess, struct GrFlushInfo const &, class skgpu::MutableTextureState const *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDirectContextPriv.cpp:92:47
    #17 0x7fff1541794a in GrDirectContextPriv::flushSurface C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDirectContextPriv.h:106
    #18 0x7fff1541794a in GrDirectContext::flush(class SkSurface *, struct GrFlushInfo const &, class skgpu::MutableTextureState const *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDirectContext.cpp:520:25
    #19 0x7fff150c88ed in skgpu::ganesh::Flush(class SkSurface *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\surface\SkSurface_Ganesh.cpp:759:45
    #20 0x7fff1937ff06 in gpu::SharedContextState::FlushWriteAccess(class gpu::SkiaImageRepresentation::ScopedWriteAccess *) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\shared_context_state.cc:869:9
    #21 0x7fff19627512 in gpu::raster::RasterDecoderImpl::DoEndRasterCHROMIUM(void) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\raster_decoder.cc:3099:30
    #22 0x7fff19622078 in gpu::raster::RasterDecoderImpl::HandleEndRasterCHROMIUM(unsigned int, void const volatile *) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\raster_decoder_autogen.h:151:3
    #23 0x7fff1962c03d in gpu::raster::RasterDecoderImpl::DoCommandsImpl<0>(unsigned int, void const volatile *, int, int *) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\raster_decoder.cc:1526:18
    #24 0x7fff035de36b in gpu::CommandBufferService::Flush(int, class gpu::AsyncAPIInterface *) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\command_buffer_service.cc:267:35
    #25 0x7fff196e36e1 in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, class std::__Cr::vector<struct gpu::SyncToken, class std::__Cr::allocator<struct gpu::SyncToken>> const &) C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\command_buffer_stub.cc:504:22
    #26 0x7fff196e25f3 in gpu::CommandBufferStub::ExecuteDeferredRequest(class gpu::mojom::DeferredCommandBufferRequestParams &, class gpu::FenceSyncReleaseDelegate *) C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\command_buffer_stub.cc:173:7
    #27 0x7fff196af4a1 in gpu::GpuChannel::ExecuteDeferredRequest(class mojo::StructPtr<class gpu::mojom::DeferredRequestParams>, class gpu::FenceSyncReleaseDelegate *) C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\gpu_channel.cc:833:13
    #28 0x7fff196bf4cf in base::internal::DecayedFunctorTraits<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel> &&,mojo::StructPtr<gpu::mojom::DeferredRequestParams> &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:740
    #29 0x7fff196bf4cf in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel> &&,mojo::StructPtr<gpu::mojom::DeferredRequestParams> &&>,void,0,1>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:956
    #30 0x7fff196bf4cf in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel> &&,mojo::StructPtr<gpu::mojom::DeferredRequestParams> &&>,base::internal::BindState<1,1,0,void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel>,mojo::StructPtr<gpu::mojom::DeferredRequestParams> >,void (gpu::FenceSyncReleaseDelegate *)>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1069
    #31 0x7fff196bf4cf in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl gpu::GpuChannel::*&&)(class mojo::StructPtr<class gpu::mojom::DeferredRequestParams>, class gpu::FenceSyncReleaseDelegate *), class base::WeakPtr<class gpu::GpuChannel> &&, class mojo::StructPtr<class gpu::mojom::DeferredRequestParams> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl gpu::GpuChannel::*)(class mojo::StructPtr<class gpu::mojom::DeferredRequestParams>, class gpu::FenceSyncReleaseDelegate *), class base::WeakPtr<class gpu::GpuChannel>, class mojo::StructPtr<class gpu::mojom::DeferredRequestParams>>, (class gpu::FenceSyncReleaseDelegate *)>::RunOnce(class base::internal::BindStateBase *, class gpu::FenceSyncReleaseDelegate *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:982:12
    #32 0x7fff036204cb in base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:155
    #33 0x7fff036204cb in base::internal::DecayedFunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)>,gpu::FenceSyncReleaseDelegate *>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:815
    #34 0x7fff036204cb in base::internal::InvokeHelper<0,base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)> &&,gpu::FenceSyncReleaseDelegate *>,void,0>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:932
    #35 0x7fff036204cb in base::internal::Invoker<struct base::internal::FunctorTraits<class base::OnceCallback<(class gpu::FenceSyncReleaseDelegate *)> &&, class gpu::FenceSyncReleaseDelegate *>, struct base::internal::BindState<0, 1, 1, class base::OnceCallback<(class gpu::FenceSyncReleaseDelegate *)>, class base::internal::UnretainedWrapper<class gpu::FenceSyncReleaseDelegate, struct base::unretained_traits::MayNotDangle, 0>>, (void)>::RunImpl<class base::OnceCallback<(class gpu::FenceSyncReleaseDelegate *)>, class std::__Cr::tuple<class base::internal::UnretainedWrapper<class gpu::FenceSyncReleaseDelegate, struct base::unretained_traits::MayNotDangle, 0>>, 0>(class base::OnceCallback<(class gpu::FenceSyncReleaseDelegate *)> &&, class std::__Cr::tuple<class base::internal::UnretainedWrapper<class gpu::FenceSyncReleaseDelegate, struct base::unretained_traits::MayNotDangle, 0>> &&, struct std::__Cr::integer_sequence<unsigned __int64, 0>) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1069:14
    #36 0x7fff035f42f2 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:155
    #37 0x7fff035f42f2 in gpu::Scheduler::ExecuteSequence(class base::IdType<class gpu::SyncPointOrderData, unsigned int, 0, 1>) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:707:29

SUMMARY: AddressSanitizer: heap-buffer-overflow C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\BufferWriter.h:92 in skgpu::BufferWriter::write
Shadow bytes around the buggy address:
  0x11acaa5d1580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x11acaa5d1600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x11acaa5d1680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x11acaa5d1700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x11acaa5d1780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x11acaa5d1800: 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa
  0x11acaa5d1880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x11acaa5d1900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x11acaa5d1980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x11acaa5d1a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x11acaa5d1a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==46964==ADDITIONAL INFO

==46964==Note: Please include this section with the ASan report.
Task trace:
    #0 0x7fff035f28a3 in gpu::Scheduler::RunNextTask(void) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:647:27
    #1 0x7fff035f28a3 in gpu::Scheduler::RunNextTask(void) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:647:27
    #2 0x7fff035f28a3 in gpu::Scheduler::RunNextTask(void) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:647:27
    #3 0x7fff035f28a3 in gpu::Scheduler::RunNextTask(void) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:647:27


Command line: `"C:\Users\symeon\Desktop\chromium-147.0.7691.0-win64-asan\chrome.exe" --type=gpu-process --disable-gpu-sandbox --enable-gpu-rasterization --disable-gpu-driver-bug-workarounds --use-angle=vulkan --user-data-dir="C:\Users\symeon\AppData\Local\Temp\chrome-test-profile" --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=SAAAAAAAAADoAQAEAAAAAAAAAAAAAMAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=2020,i,2711572133984203719,598222915878074520,262144 --field-trial-handle=2184,i,4859281458461868149,12462582824067425576,262144 --disable-features=SkiaGraphite --variations-seed-version --pseudonymization-salt-handle=2188,i,1596115968977333280,2659678181742721290,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2180 /prefetch:2`


==46964==END OF ADDITIONAL INFO

==46964==ABORTING
[47764:48420:0217/095337.032:ERROR:content\browser\gpu\gpu_process_host.cc:999] GPU process exited unexpectedly: exit_code=1
[47764:48420:0217/095344.320:ERROR:components\device_event_log\device_event_log_impl.cc:202] [09:53:44.319] USB: usb_service_win.cc:108 SetupDiGetDeviceProperty({{A45C254E-DF1C-4EFD-8020-67D146A850E0}, 6}) failed: Element not found. (0x490)
[47764:47488:0217/095344.506:ERROR:google_apis\gcm\engine\connection_factory_impl.cc:434] Failed to connect to MCS endpoint with error -105
[47764:47488:0217/095344.508:ERROR:google_apis\gcm\engine\registration_request.cc:275] Registration URL fetching failed.

CREDIT INFORMATION Reporter credit: Symeon Paraschoudis

View on issue tracker

References

Vendor advisory Fix commit Bug tracker NVD

On This Page