New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 736654 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Jun 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference in DesktopMediaPickerDialogView::Accept

Project Member Reported by ClusterFuzz, Jun 25 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6362618519617536

Fuzzer: phoglund_webrtc_peerconnection
Job Type: linux_ubsan_vptr_chrome
Platform Id: linux

Crash Type: Null-dereference
Crash Address: 0x000000000000
Crash State:
  DesktopMediaPickerDialogView::Accept
  views::DialogClientView::AcceptWindow
  base::debug::TaskAnnotator::RunTask
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=464547:464551

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6362618519617536


Additional requirements: Requires HTTP

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: msrchandra@chromium.org
Labels: Test-Predator-Wrong M-59
Owner: braveyao@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL did not find the possible suspects.
Using Code Search for the file, "DesktopMediaPickerDialogView.h" assigning to the concern owner.

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/7af38200a094aa7e5c58e7f4d56bfdd2ba806f11

@Weiyong Yao -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Cc: phoglund@chromium.org
Where can I find the "basic_screenshare extension"? Without it I can't run the test case locally.
Cc: -msrchandra@chromium.org braveyao@chromium.org
Owner: msrchandra@chromium.org
Maybe it's due to the test script, "window.postMessage({desktopSourceTypes: ['window', 'screen']}, '*');".

Here is a wild guess without knowing the details of the testcase:
Before my cl, the window picker of desktop capture has a fixed order of "screen"->"window"->"tab". And the test will blindly choose the default screen in the first screen tab of the picker.
After my cl, the order of tab in picker is defined by the desktopSourceTypes array from testcase, here it's "window"->"screen". I guess there is no default selected item in window tab(or even no windows at all on bots) so testcase will get null source id. 

msrchandra@, could you please try to change the order in desktopSourceTypes to "screen"->"window" in the testcase to verify it, as phoglund@ is on leave?
Cc: msrchandra@chromium.org
 Issue 737135  has been merged into this issue.
Project Member

Comment 5 by ClusterFuzz, Jun 28 2017

ClusterFuzz has detected this issue as fixed in range 482763:482861.

Detailed report: https://clusterfuzz.com/testcase?key=6362618519617536

Fuzzer: phoglund_webrtc_peerconnection
Job Type: linux_ubsan_vptr_chrome
Platform Id: linux

Crash Type: Null-dereference
Crash Address: 0x000000000000
Crash State:
  DesktopMediaPickerDialogView::Accept
  views::DialogClientView::AcceptWindow
  base::debug::TaskAnnotator::RunTask
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=464547:464551
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=482763:482861

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6362618519617536


Additional requirements: Requires HTTP

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Jun 28 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6362618519617536 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment