New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 634414 link

Starred by 1 user
Status: Duplicate
Owner:
█ glebl@chromium.org
Last visit > 30 days ago
Closed: Aug 2016
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: ----
Type: Bug-Security



Sign in to add a comment

Heap-use-after-free in blink::LayoutFieldset::removeChild

Project Member Reported by ClusterFuzz, Aug 4 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6260241455120384

Fuzzer: bj_broddelwerk
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Heap-use-after-free READ 8
Crash Address: 0x61100027b070
Crash State:
  blink::LayoutFieldset::removeChild
  blink::LayoutObject::willBeDestroyed
  blink::LayoutBoxModelObject::willBeDestroyed
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=409223:409458

Minimized Testcase (4.79 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96JjAwBg-fmGvbsbi5-dWzWgZXQkR3d8Z6v_0LxRqxgWfXE6AOW4m4fh7gIFjY4zW1YNXRSUOX81ZlMl_YlprYlssqTc_awoPgVxCawgvvP_dBlKbbCRpaiaO3h_ro3l-j2r5Ziqe9WFeT-gODAMj-sdZe-EA?testcase_id=6260241455120384

Issue manually filed by: mbarbella

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by mbarbe...@chromium.org, Aug 4 2016

Owner: glebl@chromium.org
Status: Assigned (was: Untriaged)
glebl: Would you mind taking a look at this? Seems like it could be related to https://chromium.googlesource.com/chromium/src//+/c6d69f896f406c9a7801b29cb8c02a88e5b01770

Comment 2 by glebl@chromium.org, Aug 4 2016

Mergedinto: 633958
Status: Duplicate (was: Assigned)
Project Member

Comment 3 by sheriffbot@chromium.org, Nov 11 2016

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment