New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 764265 link

Starred by 3 users

Issue metadata

Status: Verified
Owner: ----
Closed: Dec 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 3
Type: Bug



Sign in to add a comment

Enforce limit on number of peer connections

Project Member Reported by nisse@chromium.org, Sep 12 2017

Issue description

Chrome Version: (copy from chrome://version)
OS: (e.g. Win7, OSX 10.9.5, etc...)

What steps will reproduce the problem?

  Create 10000+ of peer connection objects.

What is the expected result?

  Creation should either work, or fail in a controlled manner.

What happens instead?

  Render process crashes.

Recently, cluster fuzz has found two crashes due to resource exhaustion, https://bugs.chromium.org/p/chromium/issues/detail?id=739886 from July, and one duplicate found some week ago.

I can reproduce locally on gnu/linux, and what happens is that running the javascript creates a large number of peerconnections, and for each peerconnection, a few threads are created. At appr. 10000 peerconnections, we have appr. 32000 threads. Creating additional threads then fail, and the render process crashes at a failed CHECK in task_queue.cc.

Webrtc doesn't fail gracefully at resource exhaustion, so to avoid crashes caused by cluster fuzz, or by malicious javascript, I'd suggest enforcing some arbitrary limit on the number of peerconnections per tab. 500 might be a reasonable maximum.  

 

Comment 1 by guidou@chromium.org, Sep 12 2017

Cc: phoglund@chromium.org
Components: Blink>WebRTC>PeerConnection
Owner: ----
Status: Available (was: Untriaged)

Comment 2 by guidou@chromium.org, Sep 18 2017

Cc: msrchandra@chromium.org pnangunoori@chromium.org
 Issue 766040  has been merged into this issue.
Project Member

Comment 3 by ClusterFuzz, Sep 25 2017

Labels: OS-Mac
Project Member

Comment 4 by ClusterFuzz, Dec 22 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Available)
ClusterFuzz testcase 5818808479776768 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Comment 5 by nisse@chromium.org, Jan 10 2018

I'm not aware of any chromium changes to address this (e.g., enforcing some arbitrary limit on number of peerconnections). Would be nice with a link to the fix cl, if any.

Comment 6 by guidou@chromium.org, Jan 10 2018

This CL introduced the limit: r525704

Comment 7 by nisse@chromium.org, Jan 10 2018

Excellent! Thanks for the update.

Sign in to add a comment