New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 642941 link

Starred by 2 users
Status: Fixed
Owner:
lazyboy@chromium.org
Closed: Dec 2016
Cc:
█ mummare...@chromium.org
mea...@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in std::map<std::string, std::map<std::string, std::list<extensions::QuotaLimitHeur

Project Member Reported by ClusterFuzz, Aug 31 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4549090316910592

Fuzzer: meacer_chromebot_extensions
Job Type: linux_asan_chrome_chromeos
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000080
Crash State:
  std::map<std::string, std::map<std::string, std::list<extensions::QuotaLimitHeur
  extensions::QuotaService::Assess
  extensions::ExtensionFunctionDispatcher::DispatchWithCallbackInternal
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_chromeos&range=415049:415582

Minimized Testcase (71.01 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97XmqxQ1zoQE0G-1fuuiu8DwvpxWLa2fCI0Zyyal3Mc2iaONWuw7ZEypc7T7Eysf_0Q6V_pM8qqDgiE4ecGBxEjApFRs8j9uV-YS9hFsAm2_i83TdQNmy6kt_5sFfJw7LPJN0Xu_zNmbb-CXxxr5SATj8qzKgVMtAcNKViZvduXIbpgTdE?testcase_id=4549090316910592

Issue manually filed by: mummareddy

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by mummare...@chromium.org, Aug 31 2016

Components: Platform>Extensions
Labels: findit-wrong M-55 Te-Logged
Owner: lazyboy@chromium.org
Status: Assigned (was: Untriaged)
Author: lazyboy
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/ee4adef0b70f13cb80a886ef639fc910c0b5ce6f
Time: Tue May 24 00:55:16 2016
The CL last changed line 416 of file extension_function_dispatcher.cc, which is stack frame 6.

Through code search on file extension_function_dispatcher.cc, suspected CL is 
https://chromium.googlesource.com/chromium/src/+/61b2c510267c57848f2ec6c079c9eedab3b5ad3c

lazyboy@, could you please take a look and reassign if it is not related your changes.

Comment 2 by manoranj...@chromium.org, Sep 21 2016 

Gentle ping!

Comment 3 by lazyboy@chromium.org, Sep 22 2016

Cc: mea...@chromium.org
I could not repro the crash this locally, any clue on how to reproduce the behavior? It could be my CL or not, I'm not sure.

I loaded the extension from the minimized testcase. Then I opened 25 tabs to all of the fuzz-extension-run-*.html files, but no luck. I've also enabled flash [1].

I've tried both linux build and linux chromeos build.
@meacer can you help since the fuzzer name contains your username.

[1] command line:
     '--ppapi-flash-path=/usr/local/google/home/lazyboy/.config/google-chrome-beta/PepperFlash/23.0.0.166/libpepflashplayer.so --ppapi-flash-version=23.0.0.166'

Comment 4 by lazyboy@chromium.org, Nov 16 2016

Status: Started (was: Assigned)
Was able to reproduce this locally this time, it seems like a bug/race in --load-extension, if specified extension fails to load, ExtensionSystem::quota_service() returns null for extension functions coming from a component extension. For my repro the component extension was Files app.
Project Member

Comment 5 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 6 by lazyboy@chromium.org, Dec 14 2016

Status: Fixed (was: Started)
This is already fixed but commit bot didn't add the CL: r434009:
https://codereview.chromium.org/2520833003/


Marking this as fixed.
►

Sign in to add a comment