New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 747662 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Aug 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug

Blocked on:
issue 746969



Sign in to add a comment

Null-dereference READ in midi::MidiService::EndSession

Project Member Reported by ClusterFuzz, Jul 22 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6008997588238336

Fuzzer: ipc_fuzzer_gen
Job Type: windows_asan_chrome_ipc
Platform Id: windows

Crash Type: Null-dereference READ
Crash Address: 0x0000000c
Crash State:
  midi::MidiService::EndSession
  content::MidiHost::OnEndSession
  IPC::MessageT<MidiHostMsg_EndSession_Meta,std::tuple<>,void>::Dispatch<content::
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_ipc&range=488146:488166

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6008997588238336


Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Cc: msrchandra@chromium.org
Components: Internals>Core
Labels: Test-Predator-Wrong-CLs M-62
Owner: toyoshim@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL did not provide any possible suspects.
Using Code Search for the file, "midi_service.cc" assigning to the concern owner from GIT Blame.

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/0f1c3f34031ae08400afbe43c70fd71267a870b1

@toyoshim -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Components: -Internals>Core Blink>WebMIDI
Status: Started (was: Assigned)
Blockedon: 746969
Project Member

Comment 4 by bugdroid1@chromium.org, Aug 18 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/78f5e86e47e0d85ff9a2d8fd097767f6be8b7997

commit 78f5e86e47e0d85ff9a2d8fd097767f6be8b7997
Author: Takashi Toyoshima <toyoshim@google.com>
Date: Fri Aug 18 12:58:48 2017

Web MIDI: make the MidiService robust against illegal ipc sequences

Now the MidiService raises a check failure when an illegal ipc
sequence is detected. But to run with ipc fuzzer, it should be
robust against such illegal ipc sequences rather than raising a
check failure.

BUG= 746969 ,  750011 ,  747662 

Change-Id: Ica788bd5371b2352a011a5d40037ef7e0da3ee48
Reviewed-on: https://chromium-review.googlesource.com/605156
Reviewed-by: Yutaka Hirano <yhirano@chromium.org>
Commit-Queue: Takashi Toyoshima <toyoshim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#495533}
[modify] https://crrev.com/78f5e86e47e0d85ff9a2d8fd097767f6be8b7997/media/midi/midi_service.cc

Project Member

Comment 5 by ClusterFuzz, Aug 19 2017

ClusterFuzz has detected this issue as fixed in range 495542:495573.

Detailed report: https://clusterfuzz.com/testcase?key=6008997588238336

Fuzzer: ipc_fuzzer_gen
Job Type: windows_asan_chrome_ipc
Platform Id: windows

Crash Type: Null-dereference READ
Crash Address: 0x0000000c
Crash State:
  midi::MidiService::EndSession
  content::MidiHost::OnEndSession
  IPC::MessageT<MidiHostMsg_EndSession_Meta,std::tuple<>,void>::Dispatch<content::
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_ipc&range=488146:488166
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_ipc&range=495542:495573

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6008997588238336

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Aug 19 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 6008997588238336 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 7 by bugdroid1@chromium.org, Aug 21 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b5985781e77b51eab38ef967c0f4466401fd80fd

commit b5985781e77b51eab38ef967c0f4466401fd80fd
Author: Takashi Toyoshima <toyoshim@google.com>
Date: Mon Aug 21 12:08:09 2017

Web MIDI: Check valid clients in MidiManager

MidiService had a |active_clients_| to detect when it destructs
MidiManager instance, but since MidiManager has a complete set
of active clients, it would be simple and safe to ask MidiManager
to check if there is at least one active client.

Bug:  746969 ,  750011 ,  747662 
Change-Id: I1491df4bc4b20c2605c979babb11e813d25702e4
Reviewed-on: https://chromium-review.googlesource.com/622294
Reviewed-by: Yutaka Hirano <yhirano@chromium.org>
Commit-Queue: Takashi Toyoshima <toyoshim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#495918}
[modify] https://crrev.com/b5985781e77b51eab38ef967c0f4466401fd80fd/media/midi/midi_manager.cc
[modify] https://crrev.com/b5985781e77b51eab38ef967c0f4466401fd80fd/media/midi/midi_manager.h
[modify] https://crrev.com/b5985781e77b51eab38ef967c0f4466401fd80fd/media/midi/midi_service.cc
[modify] https://crrev.com/b5985781e77b51eab38ef967c0f4466401fd80fd/media/midi/midi_service.h

Sign in to add a comment