New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 652610 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Oct 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 2
Type: Bug



Sign in to add a comment

AudioRendererHost CHECKs on bad renderer behaviour

Project Member Reported by maxmorin@chromium.org, Oct 4 2016

Issue description

Version: M53 (and later)
OS: all

What steps will reproduce the problem?
(1) Renderer sends AudioHostMsg_RequestDeviceAuthorization with a non-default device ID.
(2) Before authorization is completed, renderer sends AudioHostMsg_CreateStream for the stream.

This doesn't happen during normal operation, only with buggy/compromised renderer

What is the expected output?
Either renderer kill by bad_message::ReceivedBadMessage or error reported to renderer.

What do you see instead?
Browser crash, because of the CHECK at https://cs.chromium.org/chromium/src/content/browser/renderer_host/media/audio_renderer_host.cc?sq=package:chromium&rcl=1475536681&l=498.

 
According to https://www.chromium.org/Home/chromium-security/education/security-tips-for-ipc#TOC-Safely-handle-known-bad-input, we shouldn't crash the browser on bad renderer behaviour.
Status: Verified (was: Assigned)

Comment 5 by dimu@google.com, Nov 4 2016

Labels: -merge-merged-2840
[Automated comment] removing mislabelled merge-merged-2840

Sign in to add a comment