New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 701262 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Last visit > 30 days ago
Closed: May 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in PostEvent (from PseudoTcp::process)

Project Member Reported by ClusterFuzz, Mar 14 2017

Issue description

Labels: Test-Predator-Wrong M-58
Owner: deadbeef@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL did not provide any possible CL.
Using Code Search for the file, "stream.cc" assigning to the concern owner.
Suspecting Commit#
https://chromium.googlesource.com/external/webrtc/trunk/webrtc.git/+/16378411c456de1d6b11acf309fca1ba63150049

@deadbeef -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Status: Available (was: Assigned)
Summary: Crash in PostEvent (from PseudoTcp::process) (was: Crash in PostEvent)
I don't think that commit is related, but my team can own this.
Cc: deadbeef@webrtc.org
Labels: WebRTCTriaged
Components: Blink>WebRTC>Network
Cc: sergeyu@chromium.org
Actually, since only remoting is using this code, would you want to take a look at this, sergeyu@?
As far as I can tell the problem is that the test doesn't initialize Thread::Current().
deadbeef@ are you currently looking at this one? Is it really a pri-1?
Ping.
Status: Started (was: Available)
I was going to let sergeyu@ look at this since it only affects remoting. But the fix appears simple now that I look at it, so I'll fix it.
Project Member

Comment 10 by bugdroid1@chromium.org, May 4 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/external/webrtc.git/+/70719a773df8e4ff1af6b8c8e9b6bf24e74ee500

commit 70719a773df8e4ff1af6b8c8e9b6bf24e74ee500
Author: deadbeef <deadbeef@webrtc.org>
Date: Thu May 04 19:16:28 2017

Fixing pseudotcp_parser_fuzzer crash with NO_MAIN_THREAD_WRAPPING.

The test was trying to solve this problem already with AutoThread, but
the order of variable declaration was causing it to be created after
"rtc::Thread::Current()" was already called.

BUG= chromium:701262 
TBR=pbos@webrtc.org

Review-Url: https://codereview.webrtc.org/2858343002
Cr-Commit-Position: refs/heads/master@{#18019}

[modify] https://crrev.com/70719a773df8e4ff1af6b8c8e9b6bf24e74ee500/webrtc/test/fuzzers/pseudotcp_parser_fuzzer.cc

Project Member

Comment 11 by bugdroid1@chromium.org, May 4 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/external/webrtc.git/+/70719a773df8e4ff1af6b8c8e9b6bf24e74ee500

commit 70719a773df8e4ff1af6b8c8e9b6bf24e74ee500
Author: deadbeef <deadbeef@webrtc.org>
Date: Thu May 04 19:16:28 2017

Fixing pseudotcp_parser_fuzzer crash with NO_MAIN_THREAD_WRAPPING.

The test was trying to solve this problem already with AutoThread, but
the order of variable declaration was causing it to be created after
"rtc::Thread::Current()" was already called.

BUG= chromium:701262 
TBR=pbos@webrtc.org

Review-Url: https://codereview.webrtc.org/2858343002
Cr-Commit-Position: refs/heads/master@{#18019}

[modify] https://crrev.com/70719a773df8e4ff1af6b8c8e9b6bf24e74ee500/webrtc/test/fuzzers/pseudotcp_parser_fuzzer.cc

Status: Fixed (was: Started)
Project Member

Comment 13 by ClusterFuzz, May 6 2017

ClusterFuzz has detected this issue as fixed in range 469613:469615.

Detailed report: https://clusterfuzz.com/testcase?key=4567054964490240

Fuzzer: afl_pseudotcp_parser_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  PostEvent
  rtc::FifoBuffer::ConsumeWriteBuffer
  cricket::PseudoTcp::process
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=419709:419768
Fixed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=469613:469615

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4567054964490240


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment