Null-dereference READ in midi::MidiService::EndSession |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6008997588238336 Fuzzer: ipc_fuzzer_gen Job Type: windows_asan_chrome_ipc Platform Id: windows Crash Type: Null-dereference READ Crash Address: 0x0000000c Crash State: midi::MidiService::EndSession content::MidiHost::OnEndSession IPC::MessageT<MidiHostMsg_EndSession_Meta,std::tuple<>,void>::Dispatch<content:: Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_ipc&range=488146:488166 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6008997588238336 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Jul 24 2017
,
Jul 24 2017
,
Aug 18 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/78f5e86e47e0d85ff9a2d8fd097767f6be8b7997 commit 78f5e86e47e0d85ff9a2d8fd097767f6be8b7997 Author: Takashi Toyoshima <toyoshim@google.com> Date: Fri Aug 18 12:58:48 2017 Web MIDI: make the MidiService robust against illegal ipc sequences Now the MidiService raises a check failure when an illegal ipc sequence is detected. But to run with ipc fuzzer, it should be robust against such illegal ipc sequences rather than raising a check failure. BUG= 746969 , 750011 , 747662 Change-Id: Ica788bd5371b2352a011a5d40037ef7e0da3ee48 Reviewed-on: https://chromium-review.googlesource.com/605156 Reviewed-by: Yutaka Hirano <yhirano@chromium.org> Commit-Queue: Takashi Toyoshima <toyoshim@chromium.org> Cr-Commit-Position: refs/heads/master@{#495533} [modify] https://crrev.com/78f5e86e47e0d85ff9a2d8fd097767f6be8b7997/media/midi/midi_service.cc
,
Aug 19 2017
ClusterFuzz has detected this issue as fixed in range 495542:495573. Detailed report: https://clusterfuzz.com/testcase?key=6008997588238336 Fuzzer: ipc_fuzzer_gen Job Type: windows_asan_chrome_ipc Platform Id: windows Crash Type: Null-dereference READ Crash Address: 0x0000000c Crash State: midi::MidiService::EndSession content::MidiHost::OnEndSession IPC::MessageT<MidiHostMsg_EndSession_Meta,std::tuple<>,void>::Dispatch<content:: Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_ipc&range=488146:488166 Fixed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_ipc&range=495542:495573 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6008997588238336 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Aug 19 2017
ClusterFuzz testcase 6008997588238336 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Aug 21 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/b5985781e77b51eab38ef967c0f4466401fd80fd commit b5985781e77b51eab38ef967c0f4466401fd80fd Author: Takashi Toyoshima <toyoshim@google.com> Date: Mon Aug 21 12:08:09 2017 Web MIDI: Check valid clients in MidiManager MidiService had a |active_clients_| to detect when it destructs MidiManager instance, but since MidiManager has a complete set of active clients, it would be simple and safe to ask MidiManager to check if there is at least one active client. Bug: 746969 , 750011 , 747662 Change-Id: I1491df4bc4b20c2605c979babb11e813d25702e4 Reviewed-on: https://chromium-review.googlesource.com/622294 Reviewed-by: Yutaka Hirano <yhirano@chromium.org> Commit-Queue: Takashi Toyoshima <toyoshim@chromium.org> Cr-Commit-Position: refs/heads/master@{#495918} [modify] https://crrev.com/b5985781e77b51eab38ef967c0f4466401fd80fd/media/midi/midi_manager.cc [modify] https://crrev.com/b5985781e77b51eab38ef967c0f4466401fd80fd/media/midi/midi_manager.h [modify] https://crrev.com/b5985781e77b51eab38ef967c0f4466401fd80fd/media/midi/midi_service.cc [modify] https://crrev.com/b5985781e77b51eab38ef967c0f4466401fd80fd/media/midi/midi_service.h |
||||
►
Sign in to add a comment |
||||
Comment 1 by msrchandra@chromium.org
, Jul 24 2017Components: Internals>Core
Labels: Test-Predator-Wrong-CLs M-62
Owner: toyoshim@chromium.org
Status: Assigned (was: Untriaged)