Flagging as Security because this is potentially triggerable by anyone with access to the DevTools network interface, and the Blink platform parser will soon be used to parse untrusted HTTP headers, so this will definitely *become* a security issue if left unfixed.


VULNERABILITY DETAILS

The JSON parser used by the DevTools inspector protocol (gen/blink/platform/inspector_protocol/InspectorProtocol.cpp) will read past the end of its character buffer if the final character of its input is a "\" character.

In two places, it uses a structure like this:

    while (start < end) {
        CharType c = *start++;
        if ('\\' == c) {
            c = *start++;

Which will read past the end of the string if it ends in an incomplete escape sequence.

The same code, as ported to platform/json exists in the parser there (JSONParser.cpp), and suffers from the same issue. That parser, however, is not currently used anywhere in Chrome.

The DevTools parser may be accessible over the network when Chrome is running. I haven't looked into the impact of sending malformed messages there.

VERSION
Chrome Version: ToT [55.0.2875.0]
Operating System: All

I have a patch for this, including test cases which should be triggered on an LSAN bot, and a new fuzzer for the JSON parser, which I can upload as soon as I figure out how to restrict the visibility of a Rietveld CL.