CVE-2026-5274

High chrome Integer Overflow 📄 Reporter bug report 🔧 Commit mapped

Overview

High

Severity

—

CVSS

Exploited ITW

Fixed

Fix Status

ImpactInteger overflow in Codecs

DescriptionInteger overflow in Codecs

ComponentCodecs

Bug ClassInteger Overflow

Tracker488596746

Fix commitdf5f12318313 (skia) +12/-5

CISA KEVNot listed

Creditedheapracer (@heapracer)

Disclosed2026-03-31

Changed Functions

Function	Change	Notes
`for` src/codec/SkJpegMultiPicture.cpp	modified
`if` src/codec/SkJpegMultiPicture.cpp	modified

Files Changed

src/codec/SkJpegMultiPicture.cpp

Patch

view commit

From df5f12318313254224cb284b56c979bf55ba2dd7 Mon Sep 17 00:00:00 2001
From: Christopher Cameron <ccameron@chromium.org>
Date: Mon, 09 Mar 2026 21:30:58 +0000
Subject: [PATCH] SkJpegMultiPictureParameters: Fix out of bounds read

Fix a bug where the MPEntries array can be read out of bounds.

This can happen because the bounds check did not check for overflow. Fix
that. Also, change the inner loop to extract a separate SkData for each
MPEntry and fail if that extraction fails.

A more robust solution would be to have create a SkMemoryStream for
mpEntriesData, but that will require a version of
SkStreamPriv::ReadU16BE with a parametric endian-ness, which will be
added in a follow-on patch (this patch is smaller to enable merging if
needed).

Change-Id: Id3f9ce45209de28990670f6a2d82c7bc639eeea5
Bug: 488596746
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1181498
Reviewed-by: Kaylee Lubick <kjlubick@google.com>
Reviewed-by: Christopher Cameron <ccameron@google.com>
Commit-Queue: Christopher Cameron <ccameron@google.com>
---

diff --git a/src/codec/SkJpegMultiPicture.cpp b/src/codec/SkJpegMultiPicture.cpp
index c099850..9c34fc9 100644
--- a/src/codec/SkJpegMultiPicture.cpp
+++ b/src/codec/SkJpegMultiPicture.cpp
@@ -10,6 +10,7 @@
 #include "include/core/SkData.h"
 #include "include/core/SkStream.h"
 #include "src/base/SkEndian.h"
+#include "src/base/SkSafeMath.h"
 #include "src/codec/SkCodecPriv.h"
 #include "src/codec/SkJpegConstants.h"
 #include "src/codec/SkJpegSegmentScan.h"
@@ -127,7 +128,9 @@
                     SkCodecPrintf("MP entries data could not be extracted.\n");
                     return nullptr;
                 }
-                if (mpEntriesData->size() != kMPEntrySize * numberOfImages) {
+                SkSafeMath expectedSizeSafe;
+                const size_t expectedSize = expectedSizeSafe.mul(kMPEntrySize, numberOfImages);
+                if (!expectedSizeSafe.ok() || mpEntriesData->size() != expectedSize) {
                     SkCodecPrintf("MP entries data should be %ux%u bytes, was %u.\n",
                                   kMPEntrySize,
                                   numberOfImages,
@@ -179,10 +182,14 @@
 
     // Parse the MP Entries data.
     for (uint32_t i = 0; i < numberOfImages; ++i) {
-        const uint8_t* mpEntryData = mpEntriesData->bytes() + kMPEntrySize * i;
-        const uint32_t attribute = SkCodecPriv::GetEndianInt(mpEntryData + 0, littleEndian);
-        const uint32_t size = SkCodecPriv::GetEndianInt(mpEntryData + 4, littleEndian);
-        const uint32_t dataOffset = SkCodecPriv::GetEndianInt(mpEntryData + 8, littleEndian);
+        const auto mpEntry = mpEntriesData->shareSubset(kMPEntrySize * i, kMPEntrySize);
+        if (!mpEntry) {
+            SkCodecPrintf("MP Entry data unavailable\n");
+            return nullptr;
+        }
+        const uint32_t attribute = SkCodecPriv::GetEndianInt(mpEntry->bytes() + 0, littleEndian);
+        const uint32_t size = SkCodecPriv::GetEndianInt(mpEntry->bytes() + 4, littleEndian);
+        const uint32_t dataOffset = SkCodecPriv::GetEndianInt(mpEntry->bytes() + 8, littleEndian);
 
         const bool isPrimary =
                 (attribute & kMPEntryAttributeTypeMask) == kMPEntryAttributeTypePrimary;

Loading diff…

Original Bug Report

reported by sh...@gmail.com

Skia JPEG MPF integer overflow in SkJpegMultiPictureParameters::Make leading to OOB Read/Write

VULNERABILITY DETAILS

A crafted JPEG with malformed MPF metadata triggers memory-unsafe behavior in Skia JPEG multi-picture parsing.

Root cause:

In SkJpegMultiPictureParameters::Make (third_party/skia/src/codec/SkJpegMultiPicture.cpp), the parser validates MP-entry size with 32-bit arithmetic:
- mpEntriesData->size() != kMPEntrySize * numberOfImages
kMPEntrySize is 16 and numberOfImages is attacker-controlled from MPF tags.
With numberOfImages = 0x10000001, 16 * numberOfImages wraps in 32-bit to 0x10, so a tiny 16-byte MP-entry buffer passes validation even though true required size is 0x100000010.

This causes out-of-bounds reads when parsing MP entries (SkCodecPriv::GetEndianInt), and attacker-influenced writes into SkJpegMultiPictureParameters::images[i] fields (size, dataOffset) during the parse loop.

Crash Log:

=================================================================
==3856572==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7e6faf7a8857 at pc 0x7f6110c7bd39 bp 0x7ffd89b4a1e0 sp 0x7ffd89b4a1d8
READ of size 1 at 0x7e6faf7a8857 thread T0 (chrome)
    #0 0x7f6110c7bd38 in SkCodecPriv::GetEndianInt(unsigned char const*, bool) third_party/skia/src/codec/SkCodecPriv.h:292:35
    #1 0x7f6110d7a38d in SkJpegMultiPictureParameters::Make(sk_sp<SkData const> const&) third_party/skia/src/codec/SkJpegMultiPicture.cpp:183:36
    #2 0x7f6110d701be in find_mp_params(std::__Cr::vector<SkJpegMetadataDecoder::Segment, std::__Cr::allocator<SkJpegMetadataDecoder::Segment>> const&, SkJpegSourceMgr*, SkJpegSegment*) third_party/skia/src/codec/SkJpegMetadataDecoderImpl.cpp:61:20
    #3 0x7f6110d7205d in SkJpegMetadataDecoderImpl::mightHaveGainmapImage() const third_party/skia/src/codec/SkJpegMetadataDecoderImpl.cpp:474:12
    #4 0x7f5ff9e74847 in blink::JPEGImageDecoder::GetGainmapInfoAndData(SkGainmapInfo&, scoped_refptr<blink::SegmentReader>&) const third_party/blink/renderer/platform/image-decoders/jpeg/jpeg_image_decoder.cc:1003:26
    #5 0x7f600f2628fd in blink::DeferredImageDecoder::ActivateLazyGainmapDecoding() third_party/blink/renderer/platform/graphics/deferred_image_decoder.cc:372:27
    #6 0x7f600f261c4a in blink::DeferredImageDecoder::ActivateLazyDecoding() third_party/blink/renderer/platform/graphics/deferred_image_decoder.cc:334:3
    #7 0x7f600f260b27 in blink::DeferredImageDecoder::PrepareLazyDecodedFrames() third_party/blink/renderer/platform/graphics/deferred_image_decoder.cc:428:3
    #8 0x7f600f25d43e in blink::DeferredImageDecoder::SetDataInternal(scoped_refptr<blink::SharedBuffer>, bool, bool) third_party/blink/renderer/platform/graphics/deferred_image_decoder.cc:221:5
    #9 0x7f600f2605b9 in blink::DeferredImageDecoder::SetData(scoped_refptr<blink::SharedBuffer>, bool) third_party/blink/renderer/platform/graphics/deferred_image_decoder.cc:209:3
    #10 0x7f600ef5ae74 in blink::BitmapImage::SetData(scoped_refptr<blink::SharedBuffer>, bool) third_party/blink/renderer/platform/graphics/bitmap_image.cc:242:15
    #11 0x7f602e1816ff in blink::ImageResourceContent::UpdateImage(scoped_refptr<blink::SharedBuffer>, blink::ResourceStatus, blink::ImageResourceContent::UpdateImageOption, bool, bool) third_party/blink/renderer/core/loader/resource/image_resource_content.cc:505:35
    #12 0x7f602e15501f in blink::ImageResource::UpdateImage(scoped_refptr<blink::SharedBuffer>, blink::ImageResourceContent::UpdateImageOption, bool) third_party/blink/renderer/core/loader/resource/image_resource.cc:674:31
    #13 0x7f602e158899 in blink::ImageResource::Finish(base::TimeTicks, base::SingleThreadTaskRunner*) third_party/blink/renderer/core/loader/resource/image_resource.cc:545:5
    #14 0x7f6010447600 in blink::ResourceFetcher::HandleLoaderFinish(blink::Resource*, base::TimeTicks, blink::ResourceFetcher::LoaderFinishType, unsigned int) third_party/blink/renderer/platform/loader/fetch/resource_fetcher.cc:2534:15
    #15 0x7f6010560a96 in blink::ResourceLoader::DidFinishLoading(base::TimeTicks, long, unsigned long, long) third_party/blink/renderer/platform/loader/fetch/resource_loader.cc:1133:13
    #16 0x7f601055cf10 in blink::ResourceLoader::DidFinishLoadingBody() third_party/blink/renderer/platform/loader/fetch/resource_loader.cc:366:5
    #17 0x7f601060a1dd in blink::ResponseBodyLoader::DidFinishLoadingBody() third_party/blink/renderer/platform/loader/fetch/response_body_loader.cc:458:12
    #18 0x7f601060f82f in blink::ResponseBodyLoader::OnStateChange() third_party/blink/renderer/platform/loader/fetch/response_body_loader.cc:660:7
    #19 0x7f60102f6793 in blink::DataPipeBytesConsumer::SignalComplete() third_party/blink/renderer/platform/loader/fetch/data_pipe_bytes_consumer.cc:202:15
    #20 0x7f60102f5eca in blink::DataPipeBytesConsumer::CompletionNotifier::SignalComplete() third_party/blink/renderer/platform/loader/fetch/data_pipe_bytes_consumer.cc:21:22
    #21 0x7f601055fd6f in blink::ResourceLoader::DidFinishLoading(base::TimeTicks, long, unsigned long, long) third_party/blink/renderer/platform/loader/fetch/resource_loader.cc:1114:39
    #22 0x7f6010675498 in blink::BackgroundURLLoader::Context::OnCompletedRequest(network::URLLoaderCompletionStatus const&) third_party/blink/renderer/platform/loader/fetch/url_loader/background_url_loader.cc:526:16
    #23 0x7f6010675ee9 in void base::internal::DecayedFunctorTraits<void (blink::BackgroundURLLoader::Context::*)(network::URLLoaderCompletionStatus const&), scoped_refptr<blink::BackgroundURLLoader::Context>&&, network::URLLoaderCompletionStatus&&>::Invoke<void (blink::BackgroundURLLoader::Context::*)(network::URLLoaderCompletionStatus const&), scoped_refptr<blink::BackgroundURLLoader::Context>, network::URLLoaderCompletionStatus>(void (blink::BackgroundURLLoader::Context::*)(network::URLLoaderCompletionStatus const&), scoped_refptr<blink::BackgroundURLLoader::Context>&&, network::URLLoaderCompletionStatus&&) base/functional/bind_internal.h:740:12
    #24 0x7f6010675e30 in void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (blink::BackgroundURLLoader::Context::*&&)(network::URLLoaderCompletionStatus const&), scoped_refptr<blink::BackgroundURLLoader::Context>&&, network::URLLoaderCompletionStatus&&>, void, 0ul, 1ul>::MakeItSo<void (blink::BackgroundURLLoader::Context::*)(network::URLLoaderCompletionStatus const&), std::__Cr::tuple<scoped_refptr<blink::BackgroundURLLoader::Context>, network::URLLoaderCompletionStatus>>(void (blink::BackgroundURLLoader::Context::*&&)(network::URLLoaderCompletionStatus const&), std::__Cr::tuple<scoped_refptr<blink::BackgroundURLLoader::Context>, network::URLLoaderCompletionStatus>&&) base/functional/bind_internal.h:932:12
    #25 0x7f6010675c51 in void base::internal::Invoker<base::internal::FunctorTraits<void (blink::BackgroundURLLoader::Context::*&&)(network::URLLoaderCompletionStatus const&), scoped_refptr<blink::BackgroundURLLoader::Context>&&, network::URLLoaderCompletionStatus&&>, base::internal::BindState<true, true, false, void (blink::BackgroundURLLoader::Context::*)(network::URLLoaderCompletionStatus const&), scoped_refptr<blink::BackgroundURLLoader::Context>, network::URLLoaderCompletionStatus>, void ()>::RunImpl<void (blink::BackgroundURLLoader::Context::*)(network::URLLoaderCompletionStatus const&), std::__Cr::tuple<scoped_refptr<blink::BackgroundURLLoader::Context>, network::URLLoaderCompletionStatus>, 0ul, 1ul>(void (blink::BackgroundURLLoader::Context::*&&)(network::URLLoaderCompletionStatus const&), std::__Cr::tuple<scoped_refptr<blink::BackgroundURLLoader::Context>, network::URLLoaderCompletionStatus>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul>) base/functional/bind_internal.h:1069:14
    #26 0x7f6010675ac8 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::BackgroundURLLoader::Context::*&&)(network::URLLoaderCompletionStatus const&), scoped_refptr<blink::BackgroundURLLoader::Context>&&, network::URLLoaderCompletionStatus&&>, base::internal::BindState<true, true, false, void (blink::BackgroundURLLoader::Context::*)(network::URLLoaderCompletionStatus const&), scoped_refptr<blink::BackgroundURLLoader::Context>, network::URLLoaderCompletionStatus>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:982:12
    #27 0x7f600e7cba92 in base::OnceCallback<void ()>::Run() && base/functional/callback.h:155:12
    #28 0x7f600ef1e004 in blink::CrossThreadOnceFunction<void ()>::Run() && third_party/blink/renderer/platform/wtf/functional.h:311:33
    #29 0x7f6010669a9c in blink::BackgroundURLLoader::Context::RunTasksOnMainThread() third_party/blink/renderer/platform/loader/fetch/url_loader/background_url_loader.cc:454:23
    #30 0x7f601065d941 in void base::internal::DecayedFunctorTraits<void (blink::BackgroundURLLoader::Context::*)(), scoped_refptr<blink::BackgroundURLLoader::Context>&&>::Invoke<void (blink::BackgroundURLLoader::Context::*)(), scoped_refptr<blink::BackgroundURLLoader::Context>>(void (blink::BackgroundURLLoader::Context::*)(), scoped_refptr<blink::BackgroundURLLoader::Context>&&) base/functional/bind_internal.h:740:12
    #31 0x7f601065d887 in void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (blink::BackgroundURLLoader::Context::*&&)(), scoped_refptr<blink::BackgroundURLLoader::Context>&&>, void, 0ul>::MakeItSo<void (blink::BackgroundURLLoader::Context::*)(), std::__Cr::tuple<scoped_refptr<blink::BackgroundURLLoader::Context>>>(void (blink::BackgroundURLLoader::Context::*&&)(), std::__Cr::tuple<scoped_refptr<blink::BackgroundURLLoader::Context>>&&) base/functional/bind_internal.h:932:12
    #32 0x7f601065d6f1 in void base::internal::Invoker<base::internal::FunctorTraits<void (blink::BackgroundURLLoader::Context::*&&)(), scoped_refptr<blink::BackgroundURLLoader::Context>&&>, base::internal::BindState<true, true, false, void (blink::BackgroundURLLoader::Context::*)(), scoped_refptr<blink::BackgroundURLLoader::Context>>, void ()>::RunImpl<void (blink::BackgroundURLLoader::Context::*)(), std::__Cr::tuple<scoped_refptr<blink::BackgroundURLLoader::Context>>, 0ul>(void (blink::BackgroundURLLoader::Context::*&&)(), std::__Cr::tuple<scoped_refptr<blink::BackgroundURLLoader::Context>>&&, std::__Cr::integer_sequence<unsigned long, 0ul>) base/functional/bind_internal.h:1069:14
    #33 0x7f601065d588 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::BackgroundURLLoader::Context::*&&)(), scoped_refptr<blink::BackgroundURLLoader::Context>&&>, base::internal::BindState<true, true, false, void (blink::BackgroundURLLoader::Context::*)(), scoped_refptr<blink::BackgroundURLLoader::Context>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:982:12
    #34 0x7f6119e35d12 in base::OnceCallback<void ()>::Run() && base/functional/callback.h:155:12
    #35 0x7f611a3628de in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/task/common/task_annotator.cc:229:34
    #36 0x7f611a492f07 in void base::TaskAnnotator::RunTask<base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)::$_4>(perfetto::StaticString, base::PendingTask&, base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)::$_4&&) base/task/common/task_annotator.h:112:5
    #37 0x7f611a491efe in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:475:23
    #38 0x7f611a490c7a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:346:40
    #39 0x7f611a4923d2 in non-virtual thunk to base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc
    #40 0x7f6119fb18a4 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #41 0x7f611a494072 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:650:12
    #42 0x7f611a1ea787 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #43 0x7f61022244b5 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:364:16
    #44 0x7f6102d0e6ca in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #45 0x7f6102d0ff03 in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #46 0x7f6102d136f6 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #47 0x7f6102d0954f in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #48 0x7f6102d0a3c5 in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #49 0x556268331dc0 in ChromeMain chrome/app/chrome_main.cc:191:12
    #50 0x556268331621 in main chrome/app/chrome_exe_main_aura.cc:17:10
    #51 0x7f5fd8e4ed8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

0x7e6faf7a8857 is located 0 bytes after 65623-byte region [0x7e6faf798800,0x7e6faf7a8857)
allocated by thread T0 (chrome) here:
    #0 0x5562682ed694 in malloc (/mnt/lvm_data/chromium/src/out/asan_dbg_symbols/chrome+0xf386694) (BuildId: f1c93601b224f8ea)
    #1 0x7f5ffc01cd08 in chromium_jpeg_get_large third_party/libjpeg_turbo/src/jmemnobs.c:51:18
    #2 0x7f5ffc016a73 in alloc_large third_party/libjpeg_turbo/src/jmemmgr.c:392:29
    #3 0x7f5ffbff60fd in save_marker third_party/libjpeg_turbo/src/jdmarker.c:782:9
    #4 0x7f5ffbff3c38 in read_markers third_party/libjpeg_turbo/src/jdmarker.c:1082:12
    #5 0x7f5ffbfebb68 in consume_markers third_party/libjpeg_turbo/src/jdinput.c:339:9
    #6 0x7f5ffbfda4eb in chromium_jpeg_consume_input third_party/libjpeg_turbo/src/jdapimin.c:327:15
    #7 0x7f5ffbfda1e9 in chromium_jpeg_read_header third_party/libjpeg_turbo/src/jdapimin.c:275:13
    #8 0x7f5ff9e7c85a in blink::JPEGImageReader::Decode(blink::JPEGImageDecoder::DecodingMode) third_party/blink/renderer/platform/image-decoders/jpeg/jpeg_image_decoder.cc:386:13
    #9 0x7f5ff9e7418a in blink::JPEGImageDecoder::Decode(blink::JPEGImageDecoder::DecodingMode) third_party/blink/renderer/platform/image-decoders/jpeg/jpeg_image_decoder.cc:1346:17
    #10 0x7f5ff9e75566 in blink::JPEGImageDecoder::DecodeSize() third_party/blink/renderer/platform/image-decoders/jpeg/jpeg_image_decoder.cc:1088:3
    #11 0x7f5ff9e1ddd3 in blink::ImageDecoder::IsSizeAvailable() third_party/blink/renderer/platform/image-decoders/image_decoder.cc:488:5
    #12 0x7f600f260929 in blink::DeferredImageDecoder::PrepareLazyDecodedFrames() third_party/blink/renderer/platform/graphics/deferred_image_decoder.cc:411:49
    #13 0x7f600f25d43e in blink::DeferredImageDecoder::SetDataInternal(scoped_refptr<blink::SharedBuffer>, bool, bool) third_party/blink/renderer/platform/graphics/deferred_image_decoder.cc:221:5
    #14 0x7f600f25d09f in blink::DeferredImageDecoder::Create(scoped_refptr<blink::SharedBuffer>, bool, blink::ImageDecoder::AlphaOption, blink::ColorBehavior) third_party/blink/renderer/platform/graphics/deferred_image_decoder.cc:84:12
    #15 0x7f600ef5aeec in blink::BitmapImage::SetData(scoped_refptr<blink::SharedBuffer>, bool) third_party/blink/renderer/platform/graphics/bitmap_image.cc:247:14
    #16 0x7f602e1816ff in blink::ImageResourceContent::UpdateImage(scoped_refptr<blink::SharedBuffer>, blink::ResourceStatus, blink::ImageResourceContent::UpdateImageOption, bool, bool) third_party/blink/renderer/core/loader/resource/image_resource_content.cc:505:35
    #17 0x7f602e15501f in blink::ImageResource::UpdateImage(scoped_refptr<blink::SharedBuffer>, blink::ImageResourceContent::UpdateImageOption, bool) third_party/blink/renderer/core/loader/resource/image_resource.cc:674:31
    #18 0x7f602e15666b in blink::ImageResource::AppendData(std::__Cr::variant<blink::SegmentedBuffer, base::span<char const, 18446744073709551615ul, char const*>>) third_party/blink/renderer/core/loader/resource/image_resource.cc:457:7
    #19 0x7f6010597e55 in blink::ResourceLoader::DidReceiveDataImpl(std::__Cr::variant<blink::SegmentedBuffer, base::span<char const, 18446744073709551615ul, char const*>>) third_party/blink/renderer/platform/loader/fetch/resource_loader.cc:1053:14
    #20 0x7f601059cf9c in blink::ResourceLoader::DidReceiveData(base::span<char const, 18446744073709551615ul, char const*>) third_party/blink/renderer/platform/loader/fetch/resource_loader.cc:1027:3
    #21 0x7f601060817a in blink::ResponseBodyLoader::DidReceiveData(base::span<char const, 18446744073709551615ul, char const*>) third_party/blink/renderer/platform/loader/fetch/response_body_loader.cc:433:12
    #22 0x7f601060eca4 in blink::ResponseBodyLoader::OnStateChange() third_party/blink/renderer/platform/loader/fetch/response_body_loader.cc:642:9
    #23 0x7f601060c025 in blink::ResponseBodyLoader::Start() third_party/blink/renderer/platform/loader/fetch/response_body_loader.cc:515:3
    #24 0x7f601055a5ec in blink::ResourceLoader::DidStartLoadingResponseBodyInternal(blink::BytesConsumer&) third_party/blink/renderer/platform/loader/fetch/resource_loader.cc:345:28
    #25 0x7f6010588171 in blink::ResourceLoader::DidReceiveResponse(blink::WebURLResponse const&, std::__Cr::variant<mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, blink::SegmentedBuffer>, std::__Cr::optional<mojo_base::BigBuffer>) third_party/blink/renderer/platform/loader/fetch/resource_loader.cc:786:3
    #26 0x7f60106716c0 in blink::BackgroundURLLoader::Context::OnReceivedResponse(mojo::StructPtr<network::mojom::URLResponseHead>, std::__Cr::variant<mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, blink::SegmentedBuffer>, std::__Cr::optional<mojo_base::BigBuffer>, int) third_party/blink/renderer/platform/loader/fetch/url_loader/background_url_loader.cc:492:14
    #27 0x7f60106722d8 in void base::internal::DecayedFunctorTraits<void (blink::BackgroundURLLoader::Context::*)(mojo::StructPtr<network::mojom::URLResponseHead>, std::__Cr::variant<mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, blink::SegmentedBuffer>, std::__Cr::optional<mojo_base::BigBuffer>, int), scoped_refptr<blink::BackgroundURLLoader::Context>&&, mojo::StructPtr<network::mojom::URLResponseHead>&&, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>&&, std::__Cr::optional<mojo_base::BigBuffer>&&>::Invoke<void (blink::BackgroundURLLoader::Context::*)(mojo::StructPtr<network::mojom::URLResponseHead>, std::__Cr::variant<mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, blink::SegmentedBuffer>, std::__Cr::optional<mojo_base::BigBuffer>, int), scoped_refptr<blink::BackgroundURLLoader::Context>, mojo::StructPtr<network::mojom::URLResponseHead>, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, std::__Cr::optional<mojo_base::BigBuffer>, int>(void (blink::BackgroundURLLoader::Context::*)(mojo::StructPtr<network::mojom::URLResponseHead>, std::__Cr::variant<mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, blink::SegmentedBuffer>, std::__Cr::optional<mojo_base::BigBuffer>, int), scoped_refptr<blink::BackgroundURLLoader::Context>&&, mojo::StructPtr<network::mojom::URLResponseHead>&&, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>&&, std::__Cr::optional<mojo_base::BigBuffer>&&, int&&) base/functional/bind_internal.h:740:12
    #28 0x7f6010671fde in void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (blink::BackgroundURLLoader::Context::*&&)(mojo::StructPtr<network::mojom::URLResponseHead>, std::__Cr::variant<mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, blink::SegmentedBuffer>, std::__Cr::optional<mojo_base::BigBuffer>, int), scoped_refptr<blink::BackgroundURLLoader::Context>&&, mojo::StructPtr<network::mojom::URLResponseHead>&&, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>&&, std::__Cr::optional<mojo_base::BigBuffer>&&>, void, 0ul, 1ul, 2ul, 3ul>::MakeItSo<void (blink::BackgroundURLLoader::Context::*)(mojo::StructPtr<network::mojom::URLResponseHead>, std::__Cr::variant<mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, blink::SegmentedBuffer>, std::__Cr::optional<mojo_base::BigBuffer>, int), std::__Cr::tuple<scoped_refptr<blink::BackgroundURLLoader::Context>, mojo::StructPtr<network::mojom::URLResponseHead>, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, std::__Cr::optional<mojo_base::BigBuffer>>, int>(void (blink::BackgroundURLLoader::Context::*&&)(mojo::StructPtr<network::mojom::URLResponseHead>, std::__Cr::variant<mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, blink::SegmentedBuffer>, std::__Cr::optional<mojo_base::BigBuffer>, int), std::__Cr::tuple<scoped_refptr<blink::BackgroundURLLoader::Context>, mojo::StructPtr<network::mojom::URLResponseHead>, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, std::__Cr::optional<mojo_base::BigBuffer>>&&, int&&) base/functional/bind_internal.h:932:12
    #29 0x7f6010671d43 in void base::internal::Invoker<base::internal::FunctorTraits<void (blink::BackgroundURLLoader::Context::*&&)(mojo::StructPtr<network::mojom::URLResponseHead>, std::__Cr::variant<mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, blink::SegmentedBuffer>, std::__Cr::optional<mojo_base::BigBuffer>, int), scoped_refptr<blink::BackgroundURLLoader::Context>&&, mojo::StructPtr<network::mojom::URLResponseHead>&&, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>&&, std::__Cr::optional<mojo_base::BigBuffer>&&>, base::internal::BindState<true, true, false, void (blink::BackgroundURLLoader::Context::*)(mojo::StructPtr<network::mojom::URLResponseHead>, std::__Cr::variant<mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, blink::SegmentedBuffer>, std::__Cr::optional<mojo_base::BigBuffer>, int), scoped_refptr<blink::BackgroundURLLoader::Context>, mojo::StructPtr<network::mojom::URLResponseHead>, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, std::__Cr::optional<mojo_base::BigBuffer>>, void (int)>::RunImpl<void (blink::BackgroundURLLoader::Context::*)(mojo::StructPtr<network::mojom::URLResponseHead>, std::__Cr::variant<mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, blink::SegmentedBuffer>, std::__Cr::optional<mojo_base::BigBuffer>, int), std::__Cr::tuple<scoped_refptr<blink::BackgroundURLLoader::Context>, mojo::StructPtr<network::mojom::URLResponseHead>, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, std::__Cr::optional<mojo_base::BigBuffer>>, 0ul, 1ul, 2ul, 3ul>(void (blink::BackgroundURLLoader::Context::*&&)(mojo::StructPtr<network::mojom::URLResponseHead>, std::__Cr::variant<mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, blink::SegmentedBuffer>, std::__Cr::optional<mojo_base::BigBuffer>, int), std::__Cr::tuple<scoped_refptr<blink::BackgroundURLLoader::Context>, mojo::StructPtr<network::mojom::URLResponseHead>, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, std::__Cr::optional<mojo_base::BigBuffer>>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul>, int&&) base/functional/bind_internal.h:1069:14

SUMMARY: AddressSanitizer: heap-buffer-overflow third_party/skia/src/codec/SkCodecPriv.h:292:35 in SkCodecPriv::GetEndianInt(unsigned char const*, bool)
Shadow bytes around the buggy address:
  0x7e6faf7a8580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7e6faf7a8600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7e6faf7a8680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7e6faf7a8700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7e6faf7a8780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7e6faf7a8800: 00 00 00 00 00 00 00 00 00 00[07]fa fa fa fa fa
  0x7e6faf7a8880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7e6faf7a8900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7e6faf7a8980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7e6faf7a8a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7e6faf7a8a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==3856572==ADDITIONAL INFO

==3856572==Note: Please include this section with the ASan report.
Task trace:
    #0 0x7f601066939a in blink::BackgroundURLLoader::Context::PostTaskToMainThread(blink::CrossThreadOnceFunction<void ()>) third_party/blink/renderer/platform/loader/fetch/url_loader/background_url_loader.cc:422:52
    #1 0x7f61175c47b8 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13


Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=3840477 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chromium-cdp-profile-8_f83a6t --change-stack-guard-on-fork=enable --no-sandbox --disable-dev-shm-usage --remote-debugging-port=58341 --ozone-platform=headless --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1755397479121000 --launch-time-ticks=16919866895654 --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,18360823009163257586,8577354655934701638,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,10546060741813747647,2610201529368585060,4 --trace-process-track-uuid=3362606884126403353 --enable-logging=stderr`


==3856572==END OF ADDITIONAL INFO

VERSION

Chrome Version: 146.0.7639.0 (local Chromium Release build, dev/mainline-style) + dev Operating System: Ubuntu 22.04.3 LTS (Jammy), Linux 5.15.0-151-generic x86_64

REPRODUCTION CASE

PoC files:

skia-mpf-get-endian-int-20260228_032208.html

Directly opening it would crash with ASAN logs.

Type of crash: renderer/tab crash (target crash after file load)

CREDIT INFORMATION

Reporter credit: heapracer (@heapracer)

View on issue tracker

References

Vendor advisory Fix commit Bug tracker NVD

On This Page