I can repro locally as well. Can someone from the network team please take a look? Thanks.

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

cbentzel: Can you suggest a good owner for this?

Is the http_server used by anything other than test code?

Temporarily assigning to morlovich since he wrote some fuzzers in this space.

I don't think http_server has many people actively working on it, so should probably be a grab.

Looking at clusterfuzz range, the only thing that looked close was brettw's circular_deque refactor: https://chromium.googlesource.com/chromium/src/+/c6a0c827068cf51a474ec7c2dd0228c22d337689

Yeah, I wrote this fuzzer.

queue change may be a good starting point, since it's used in at least one spot:


https://cs.chromium.org/chromium/src/net/server/http_connection.h?rcl=56f290842c6f2f23291baf3a1e05bc4a091a93a1&l=106

And this looks highly suspect WRT to pointer stability, I think:
https://cs.chromium.org/chromium/src/net/server/http_connection.cc?rcl=56f290842c6f2f23291baf3a1e05bc4a091a93a1&l=123

Uploaded https://chromium-review.googlesource.com/c/chromium/src/+/667730
Also I think this may be 63 only?

This is the version that omahaproxy has a beta/M62:
https://chromium.googlesource.com/chromium/src/+/refs/tags/62.0.3202.0/net/server/http_connection.h#106
.. so it's not affected. I feel like I should remove M-62, ReleaseBlock-Stable,Security_Impact-Beta and add M-63, and Security_Impact-Head?

I agree with that - looks like it's not an M62 issue.  The revision range by the fuzzer (Which may not be entirely accurate), also only indicates it's on M-63.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/03336b6cfacda28575e9f200b2eeae4fbabe6153

commit 03336b6cfacda28575e9f200b2eeae4fbabe6153
Author: Maks Orlovich <morlovich@chromium.org>
Date: Fri Sep 15 21:39:05 2017

HttpServer: adjust QueuedWriteIOBuffer to new queue

In particular, don't assume pointer stability.


Bug:  764320 
Change-Id: Ie260aa1cef4a42869ae2ab46601d9e1143f1d5d8
Reviewed-on: https://chromium-review.googlesource.com/667730
Reviewed-by: Matt Menke <mmenke@chromium.org>
Commit-Queue: Maks Orlovich <morlovich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#502385}
[modify] https://crrev.com/03336b6cfacda28575e9f200b2eeae4fbabe6153/net/server/http_connection.cc
[modify] https://crrev.com/03336b6cfacda28575e9f200b2eeae4fbabe6153/net/server/http_connection.h
[modify] https://crrev.com/03336b6cfacda28575e9f200b2eeae4fbabe6153/net/server/http_connection_unittest.cc

ClusterFuzz has detected this issue as fixed in range 502309:502391.

Detailed report: https://clusterfuzz.com/testcase?key=5041566636048384

Fuzzer: libFuzzer_net_http_server_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Heap-use-after-free READ 1
Crash Address: 0x608000002539
Crash State:
  _ZN7logging22MakeCheckOpValueStringIPcEENSt3__19enable_ifIXaasr4base8internal23S
  std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch
  std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch
  
Sanitizer: address (ASAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=501057:501134
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=502309:502391

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5041566636048384

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5041566636048384 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot