Detailed report: https://clusterfuzz.com/testcase?key=6581930675142656 Fuzzer: phoglund_webrtc_peerconnection Job Type: linux_ubsan_vptr_chrome Platform Id: linux Crash Type: UNKNOWN Crash Address: 0x000000000000 Crash State: content::P2PSocketHostUdp::SetOption content::P2PSocketDispatcherHost::OnSetOption _ZN3IPC8MessageTI25P2PHostMsg_SetOption_MetaSt5tupleIJiN7content15P2PSocketOptio Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=466679:466715 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6581930675142656 Additional requirements: Requires HTTP Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Predator and regression range didn't given any suspected CL. could someone please take a look and help us to find correct owner?. Thank you.
This is a bug in P2PSocketHostUdp::SetOption() - it doesn't verify that the socked is still open. Should be a simple fix.
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/2523efeb9a9d25f67c6d4799d0ca6687b674517f commit 2523efeb9a9d25f67c6d4799d0ca6687b674517f Author: sergeyu <sergeyu@chromium.org> Date: Wed Apr 26 18:49:06 2017 Fix P2PSocketHostUdp to handle SetOptions() in error state Previously P2PSocketHostUdp was crashing when SetOptions is called in error state. BUG= 714951 Review-Url: https://codereview.chromium.org/2843823002 Cr-Commit-Position: refs/heads/master@{#467395} [modify] https://crrev.com/2523efeb9a9d25f67c6d4799d0ca6687b674517f/content/browser/renderer_host/p2p/socket_host_tcp.cc [modify] https://crrev.com/2523efeb9a9d25f67c6d4799d0ca6687b674517f/content/browser/renderer_host/p2p/socket_host_tcp_unittest.cc [modify] https://crrev.com/2523efeb9a9d25f67c6d4799d0ca6687b674517f/content/browser/renderer_host/p2p/socket_host_udp.cc [modify] https://crrev.com/2523efeb9a9d25f67c6d4799d0ca6687b674517f/content/browser/renderer_host/p2p/socket_host_udp_unittest.cc
Comment 1 by mummare...@chromium.org
, Apr 25 2017Components: Internals>Network
Labels: Test-Predator-Wrong M-58