[1533:1533:0525/150259.246109:INFO:third_party/skia/src/core/SkStrike.cpp:199] [POC][renderer pid=1533] injecting SK_PICT_TYPEFACE_TAG glyph drawable into OOP-raster font buffer

[1396:1396:0525/150259.260436:INFO:third_party/skia/src/ports/SkFontHost_FreeType.cpp:2076]
================================================================
[POC][pid=1396] TRUST-BOUNDARY VIOLATION CONFIRMED
  SkTypeface_FreeType::MakeFromStream() received 205 bytes that
  were authored by the (compromised) renderer and shipped via
  glRasterCHROMIUM -> SkStrikeClient::readStrikeData ->
  SkPictureBackedGlyphDrawable::MakeFromBuffer ->
  SK_PICT_TYPEFACE_TAG -> SkTypeface::MakeDeserialize.
  Next call would be FT_Open_Face() on these attacker bytes
  inside the GPU process, bypassing the SkTypefaceProxy model.
================================================================

[1396:1396:0525/150259.260576:FATAL:third_party/skia/src/ports/SkFontHost_FreeType.cpp:2078] POC: renderer font bytes reached GPU-process FreeType
    #0 0x5aa07152d3fa in ___interceptor_backtrace ??:0:0
    #1 0x5aa089d8cf68 in base::debug::CollectStackTrace(base::span<void const*, 18446744073709551615ul, void const**>) ./../../base/debug/stack_trace_posix.cc:1050:7
    #2 0x5aa089d498b7 in base::debug::StackTrace::StackTrace() ./../../base/debug/stack_trace.cc:280:20
    #3 0x5aa089a4ef4b in logging::LogMessage::Flush() ./../../base/logging.cc:708:29
    #4 0x5aa089a4ea4d in logging::LogMessage::~LogMessage() ./../../base/logging.cc:697:3
    #5 0x5aa08be25dcb in SkAbort_FileLine(char const*, int, char const*, ...) ./../../skia/ext/google_logging.cc:83:3
    #6 0x5aa08c05ef4c in SkTypeface_FreeType::MakeFromStream(std::__Cr::unique_ptr<SkStreamAsset, std::__Cr::default_delete<SkStreamAsset>>, SkFontArguments const&) ./../../third_party/skia/src/ports/SkFontHost_FreeType.cpp:2078:17
    #7 0x5aa0724d3144 in SkTypeface::MakeDeserialize(SkStream*, sk_sp<SkFontMgr>) ./../../third_party/skia/src/core/SkTypeface.cpp:249:24
    #8 0x5aa0723b37b0 in SkPictureData::parseStreamTag(SkStream*, unsigned int, unsigned int, SkDeserialProcs const&, SkTypefacePlayback*, int) ./../../third_party/skia/src/core/SkPictureData.cpp:353:26
    #9 0x5aa0723b7727 in SkPictureData::CreateFromStream(SkStream*, SkPictInfo const&, SkDeserialProcs const&, SkTypefacePlayback*, int) ./../../third_party/skia/src/core/SkPictureData.cpp:577:20
    #10 0x5aa0723a9fdf in SkPicture::MakeFromStreamPriv(SkStream*, SkDeserialProcs const*, SkTypefacePlayback*, int) ./../../third_party/skia/src/core/SkPicture.cpp:186:21
    #11 0x5aa0723aa5b3 in SkPicture::MakeFromData(SkData const*, SkDeserialProcs const*) ./../../third_party/skia/src/core/SkPicture.cpp:163:12
    #12 0x5aa072275a13 in SkPictureBackedGlyphDrawable::MakeFromBuffer(SkReadBuffer&) ./../../third_party/skia/src/core/SkGlyph.cpp:51:32
    #13 0x5aa072278fd2 in SkGlyph::addDrawableFromBuffer(SkReadBuffer&, SkArenaAlloc*) ./../../third_party/skia/src/core/SkGlyph.cpp:426:34
    #14 0x5aa072498d4f in SkStrike::mergeFromBuffer(SkReadBuffer&) ./../../third_party/skia/src/core/SkStrike.cpp:527:31
    #15 0x5aa08c4ed501 in SkStrikeClientImpl::readStrikeData(void const volatile*, unsigned long) ./../../third_party/skia/src/text/gpu/SkChromeRemoteGlyphCache.cpp:739:22
    #16 0x5aa093cfe4c8 in gpu::ServiceFontManager::Deserialize(base::span<unsigned char const volatile, 18446744073709551615ul, unsigned char const volatile*>, std::__Cr::vector<unsigned int, std::__Cr::allocator<unsigned int>>*) ./../../gpu/command_buffer/service/service_font_manager.cc:65:25
    #17 0x5aa093cf3225 in gpu::raster::RasterDecoderImpl::DoRasterCHROMIUM(unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int) ./../../gpu/command_buffer/service/raster_decoder.cc:3034:27
    #18 0x5aa093cdcc8f in gpu::raster::RasterDecoderImpl::HandleRasterCHROMIUM(unsigned int, void const volatile*) ./../../gpu/command_buffer/service/raster_decoder.cc:3087:10
    #19 0x5aa093ce7b3c in gpu::error::Error gpu::raster::RasterDecoderImpl::DoCommandsImpl<false>(unsigned int, void const volatile*, int, int*) ./../../gpu/command_buffer/service/raster_decoder.cc:1534:18
    #20 0x5aa07c7bb755 in gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*) ./../../gpu/command_buffer/service/command_buffer_service.cc:267:35
    #21 0x5aa093c53d5c in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, std::__Cr::vector<gpu::SyncToken, std::__Cr::allocator<gpu::SyncToken>> const&) ./../../gpu/ipc/service/command_buffer_stub.cc:504:22
    #22 0x5aa093c52fcd in gpu::CommandBufferStub::ExecuteDeferredRequest(gpu::mojom::DeferredCommandBufferRequestParams&, gpu::FenceSyncReleaseDelegate*) ./../../gpu/ipc/service/command_buffer_stub.cc:173:7
    #23 0x5aa093c689dd in gpu::GpuChannel::ExecuteDeferredRequest(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*) ./../../gpu/ipc/service/gpu_channel.cc:854:13
    #24 0x5aa093c77488 in void base::internal::DecayedFunctorTraits<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>::Invoke<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*>(void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&, gpu::FenceSyncReleaseDelegate*&&) ./../../base/functional/bind_internal.h:740:12
    #25 0x5aa093c7726a in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>, base::internal::BindState<true, true, false, void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>, mojo::StructPtr<gpu::mojom::DeferredRequestParams>>, void (gpu::FenceSyncReleaseDelegate*)>::RunOnce(base::internal::BindStateBase*, gpu::FenceSyncReleaseDelegate*) ./../../base/functional/bind_internal.h:956:5
    #26 0x5aa07c802a82 in void base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, gpu::FenceSyncReleaseDelegate*>, base::internal::BindState<false, true, true, base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunImpl<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul>(base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul>) ./../../base/functional/callback.h:155:12
    #27 0x5aa07c7d616f in gpu::Scheduler::ExecuteSequence(base::IdType<gpu::SyncPointOrderData, unsigned int, 0u, 1u>) ./../../base/functional/callback.h:155:12
    #28 0x5aa07c7d3b59 in gpu::Scheduler::RunNextTask() ./../../gpu/command_buffer/service/scheduler.cc:628:3
    #29 0x5aa07c7d7fe2 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::Scheduler::*&&)(), gpu::Scheduler*>, base::internal::BindState<true, true, false, void (gpu::Scheduler::*)(), base::internal::UnretainedWrapper<gpu::Scheduler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) ./../../base/functional/bind_internal.h:740:12
    #30 0x5aa089bc13e4 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) ./../../base/functional/callback.h:155:12
    #31 0x5aa089c30a9d in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) ./../../base/task/common/task_annotator.h:112:5
    #32 0x5aa089c2f93b in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #33 0x5aa089de50d9 in base::MessagePumpGlib::HandleDispatch() ./../../base/message_loop/message_pump_glib.cc:736:46
    #34 0x5aa089de8699 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) ./../../base/message_loop/message_pump_glib.cc:355:43
    #35 0x742790bc1719 in g_main_context_dispatch ??:0:0
    #36 0x742790bc19a8 in g_main_context_dispatch ??:?
    #37 0x742790bc1a3c in g_main_context_iteration ??:0:0
    #38 0x5aa089de56f4 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_glib.cc:770:30
    #39 0x5aa089c32185 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #40 0x5aa089b3b981 in base::RunLoop::Run(base::Location const&) ./../../base/run_loop.cc:135:14
    #41 0x5aa095c627ef in content::GpuMain(content::MainFunctionParams) ./../../content/gpu/gpu_main.cc:484:14
    #42 0x5aa086532dc4 in content::RunZygote(content::ContentMainDelegate*) ./../../content/app/content_main_runner_impl.cc:665:14
    #43 0x5aa0865340cc in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) ./../../content/app/content_main_runner_impl.cc:772:12
    #44 0x5aa086536fd2 in content::ContentMainRunnerImpl::Run() ./../../content/app/content_main_runner_impl.cc:1164:10
    #45 0x5aa0865307dc in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) ./../../content/app/content_main.cc:356:36
    #46 0x5aa086530dcd in content::ContentMain(content::ContentMainParams) ./../../content/app/content_main.cc:369:10
    #47 0x5aa0715c302c in ChromeMain ./../../chrome/app/chrome_main.cc:221:12
    #48 0x74278f80b24a in __libc_init_first ??:?
    #49 0x74278f80b305 in __libc_start_main ??:0:0
    #50 0x5aa0714e502a in _start ??:0:0
Task trace:
    #0 0x5aa07c7d4033 in gpu::Scheduler::RunNextTask() ./../../gpu/command_buffer/service/scheduler.cc:650:27
    #1 0x5aa07c7d4033 in gpu::Scheduler::RunNextTask() ./../../gpu/command_buffer/service/scheduler.cc:650:27
    #2 0x5aa07c7d4033 in gpu::Scheduler::RunNextTask() ./../../gpu/command_buffer/service/scheduler.cc:650:27
    #3 0x5aa07c7d4033 in gpu::Scheduler::RunNextTask() ./../../gpu/command_buffer/service/scheduler.cc:650:27
    #4 0x5aa07c7d4033 in gpu::Scheduler::RunNextTask() ./../../gpu/command_buffer/service/scheduler.cc:650:27
Task trace buffer limit hit, update PendingTask::kTaskBacktraceLength to increase.
Crash keys:
  "gpu-gl-context-is-virtual" = "0"
  "gpu-url-chunk-chrome" = "chrome://gpu/RenderThreadImpl::CreateOffscreenContext/RendererMainThread"
  "variations" = "a66dbd64-71c38a98,102166ac-3f4a17df,b13ca3d9-84f6cff8,63ef0138-3f4a17df,af00e384-3f4a17df,a4ca7cb1-3f4a17df,ae727645-d13781e7,2441c03c-3f4a17df,d6ad7f9a-a9080253,bcb58f65-3f4a17df,d7af3875-3f4a17df,4dc2f223-3f4a17df,fc1790de-3f4a17df,35c106c9-3f4a17df,f6f5c542-3f4a17df,5e05ef36-3f4a17df,3779be93-3f4a17df,305240ad-3f4a17df,3e15bfc6-3f4a17df,e9844d40-3f4a17df,fc9ceed7-ee2a48b4,4af38a69-3c635604,b0b97cfb-3f4a17df,da493d3c-3f4a17df,72bafd3e-cdb4c186,f3ed486d-3f4a17df,4076100b-3f4a17df,5e2ea1a-3f4a17df,c37d60cf-3f4a17df,dd88aa3e-3f4a17df,94b88ba6-7e2e67c9,f3dbf5bd-faff9ce0,db59f83a-3f4a17df,9cdd2223-3f4a17df,7f8767fe-3f4a17df,2f95a72f-3f4a17df,bc3ce3e6-d7cb341b,30cf4980-61673e6,797fe373-3f4a17df,6f27bc8a-3f4a17df,e5c8270a-3f4a17df,c297985a-3f4a17df,6ddea229-6ddea229,6222c570-3f4a17df,5870a003-3f4a17df,4776ceb-3f4a17df,f4f00e05-ca7d8d80,9481ce98-3d47f4f4,2a426c03-3d47f4f4,70678518-dee66fa8,be338734-dee66fa8,5f9907a9-dee66fa8,8eeccb9a-dee66fa8,2b465683-dee66fa8,52fc7926-dee66fa8,bc9b361d-dee66fa8,a41a7188-dee66fa8,ff71bfdc-dee66fa8,251fc742-dee66fa8,2159dd0c-dee66fa8,e7cc79d5-dee66fa8,4b935545-bb2d3403,ce263fae-3d47f4f4,9a38bae3-3d47f4f4,2d1e43a3-3d47f4f4,386dc267-3d47f4f4,d69d967d-3695c92e,3c8f75a1-21623f2a,"
  "num-experiments" = "68"
  "gr-context-type" = "GaneshGL"
  "egl-display-type" = "angle:OpenGL"
  "gpu-gl-renderer" = "ANGLE (Mesa/X.org, llvmpipe (LLVM 15.0.6 256 bits), OpenGL 4.5 (Core Profile) Mesa 22.3.6)"
  "gpu-gl-vendor" = "Google Inc. (Mesa/X.org)"
  "gpu-generation-intel" = "0"
  "gpu-vsver" = "3.00"
  "gpu-psver" = "3.00"
  "gpu-driver" = "22.3.6"
  "gpu_count" = "0"
  "gpu-devid" = "0x0000"
  "gpu-venid" = "0x0000"
  "chrome-trace-id" = "3589478603928450688"
  "reentry_guard_tls_slot" = "unused"
  "switch-14" = "--trace-process-track-uuid=3190708988185955192"
  "switch-13" = "--pseudonymization-salt-handle=7,i,17358922814034022522,13770397"
  "switch-12" = "--variations-seed-version"
  "switch-11" = "--field-trial-handle=3,i,15048055870339027802,105162033661628861"
  "switch-10" = "--metrics-shmem-handle=4,i,6123218528678829646,49577444630821704"
  "switch-9" = "--shared-files"
  "switch-8" = "--change-stack-guard-on-fork=enable"
  "switch-7" = "--disable-breakpad"
  "osarch" = "x86_64"
  "pid" = "1396"
  "ptype" = "gpu-process"
  "switch-6" = "--user-data-dir=/tmp/chrome-poc-profile"
  "switch-5" = "--enable-crash-reporter=,"
  "switch-4" = "--crashpad-handler-pid=1365"
  "switch-3" = "--ozone-platform=x11"