Crash in PostEvent (from PseudoTcp::process) |
|||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4567054964490240 Fuzzer: afl_pseudotcp_parser_fuzzer Job Type: afl_chrome_asan Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000000000 Crash State: PostEvent rtc::FifoBuffer::ConsumeWriteBuffer cricket::PseudoTcp::process Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=419709:419768 Reproducer Testcase: https://clusterfuzz.com/download/AMIfv97VI_XwK1UQxfskyfRYWyh5YI5hiX-FzkM9EnFI9bRp61FEdYPnYbfSpgN2TXk-RR0Lz7_AS5wpt5jc-R179M4pUozpwtw_XGvvxCABR1jfAGxFEp4pkaim3PDfAH5oMu2X9OuJDtccyCli8K9p-xwHq7ZS80lebS9nwupEym9fUwCiKr5mI7qPo2xFYNgXIom23BE-ds2DrYRw0w1Q6ayFB7oFsbQZww377qWkNp6pfZsLGivtiEKA1FKoJb3J19OckkoAgp7Sz6YI9da5aVBDpXc49O1TwVWdwlhB27WI6hqt9hZ18DWJmip7tM186bp9MCpDybftmH1Bnlyf0O66XktKJkjTm0Y1abiHR5soUnK-AIw?testcase_id=4567054964490240 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Mar 14 2017
I don't think that commit is related, but my team can own this.
,
Mar 14 2017
,
Mar 14 2017
,
Apr 7 2017
Actually, since only remoting is using this code, would you want to take a look at this, sergeyu@?
,
Apr 7 2017
As far as I can tell the problem is that the test doesn't initialize Thread::Current().
,
Apr 21 2017
deadbeef@ are you currently looking at this one? Is it really a pri-1?
,
May 4 2017
Ping.
,
May 4 2017
I was going to let sergeyu@ look at this since it only affects remoting. But the fix appears simple now that I look at it, so I'll fix it.
,
May 4 2017
The following revision refers to this bug: https://chromium.googlesource.com/external/webrtc.git/+/70719a773df8e4ff1af6b8c8e9b6bf24e74ee500 commit 70719a773df8e4ff1af6b8c8e9b6bf24e74ee500 Author: deadbeef <deadbeef@webrtc.org> Date: Thu May 04 19:16:28 2017 Fixing pseudotcp_parser_fuzzer crash with NO_MAIN_THREAD_WRAPPING. The test was trying to solve this problem already with AutoThread, but the order of variable declaration was causing it to be created after "rtc::Thread::Current()" was already called. BUG= chromium:701262 TBR=pbos@webrtc.org Review-Url: https://codereview.webrtc.org/2858343002 Cr-Commit-Position: refs/heads/master@{#18019} [modify] https://crrev.com/70719a773df8e4ff1af6b8c8e9b6bf24e74ee500/webrtc/test/fuzzers/pseudotcp_parser_fuzzer.cc
,
May 4 2017
The following revision refers to this bug: https://chromium.googlesource.com/external/webrtc.git/+/70719a773df8e4ff1af6b8c8e9b6bf24e74ee500 commit 70719a773df8e4ff1af6b8c8e9b6bf24e74ee500 Author: deadbeef <deadbeef@webrtc.org> Date: Thu May 04 19:16:28 2017 Fixing pseudotcp_parser_fuzzer crash with NO_MAIN_THREAD_WRAPPING. The test was trying to solve this problem already with AutoThread, but the order of variable declaration was causing it to be created after "rtc::Thread::Current()" was already called. BUG= chromium:701262 TBR=pbos@webrtc.org Review-Url: https://codereview.webrtc.org/2858343002 Cr-Commit-Position: refs/heads/master@{#18019} [modify] https://crrev.com/70719a773df8e4ff1af6b8c8e9b6bf24e74ee500/webrtc/test/fuzzers/pseudotcp_parser_fuzzer.cc
,
May 4 2017
,
May 6 2017
ClusterFuzz has detected this issue as fixed in range 469613:469615. Detailed report: https://clusterfuzz.com/testcase?key=4567054964490240 Fuzzer: afl_pseudotcp_parser_fuzzer Job Type: afl_chrome_asan Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000000000 Crash State: PostEvent rtc::FifoBuffer::ConsumeWriteBuffer cricket::PseudoTcp::process Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=419709:419768 Fixed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=469613:469615 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4567054964490240 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by msrchandra@chromium.org
, Mar 14 2017Owner: deadbeef@chromium.org
Status: Assigned (was: Untriaged)