Null-dereference READ in blink::WebAuthenticationClient::DispatchMakeCredential |
||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4709890370306048 Fuzzer: inferno_twister Job Type: mac_asan_chrome Platform Id: mac Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: blink::WebAuthenticationClient::DispatchMakeCredential blink::CredentialManagerClient::DispatchMakeCredential blink::CredentialsContainer::create Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=496355:496450 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4709890370306048 Additional requirements: Requires HTTP Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Oct 1 2017
Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.
,
Oct 3 2017
Test Predator has given the following results: Initial upload to reland 578729. by kpaulhamus@chromium.org Changelist touched lines near the crashed line in frame #0 blink::WebAuthenticationClient::DispatchMakeCredential(blink::MakeCredentialOptions const&, std::__1::unique_ptr<blink::WebCallbacks<mojo::StructPtr<webauth::mojom::blink::PublicKeyCredentialInfo>, blink::WebCredentialManagerError>, std::__1::default_delete<blink::WebCallbacks<mojo::StructPtr<webauth::mojom::blink::PublicKeyCredentialInfo>, blink::WebCredentialManagerError> > >) (distance = 0 lines away) Top touched frame is #0 blink::WebAuthenticationClient::DispatchMakeCredential(in WebAuthenticationClient.cpp) Changed files credentialscontainer-create-basics.html, mock-authenticator.html, AuthenticatorAssertionResponse.cpp, AuthenticatorAssertionResponse.h, AuthenticatorAssertionResponse.idl, AuthenticatorAttestationResponse.cpp, AuthenticatorAttestationResponse.h, AuthenticatorAttestationResponse.idl, AuthenticatorResponse.cpp, AuthenticatorResponse.h, AuthenticatorResponse.idl, AuthenticatorSelectionCriteria.idl, BUILD.gn, CollectedClientData.idl, CredentialCreationOptions.idl, CredentialManagerClient.cpp, CredentialManagerClient.h, CredentialRequestOptions.idl, CredentialsContainer.cpp, MakeCredentialOptions.idl, PublicKeyCredential.cpp, PublicKeyCredential.h, PublicKeyCredential.idl, PublicKeyCredentialDescriptor.idl, PublicKeyCredentialEntity.idl, PublicKeyCredentialParameters.idl, PublicKeyCredentialRequestOptions.idl, PublicKeyCredentialUserEntity.idl, WebAuthenticationClient.cpp, WebAuthenticationClient.h, with the same CrashedDirectory(third_party/WebKit/Source/modules/credentialmanager) as WebAuthenticationClient.cpp (in frame#0), CredentialsContainer.cpp (in frame#2), CredentialManagerClient.cpp (in frame#1) Touched files in stacktrace - WebAuthenticationClient.cpp, CredentialsContainer.cpp, CredentialManagerClient.cpp Changed files credential_manager_browsertest.cc, AuthenticatorAssertionResponse.cpp, AuthenticatorAssertionResponse.h, AuthenticatorAssertionResponse.idl, AuthenticatorAttestationResponse.cpp, AuthenticatorAttestationResponse.h, AuthenticatorAttestationResponse.idl, AuthenticatorResponse.cpp, AuthenticatorResponse.h, AuthenticatorResponse.idl, AuthenticatorSelectionCriteria.idl, BUILD.gn, CollectedClientData.idl, CredentialCreationOptions.idl, CredentialManagerClient.cpp, CredentialManagerClient.h, CredentialRequestOptions.idl, CredentialsContainer.cpp, MakeCredentialOptions.idl, PublicKeyCredential.cpp, PublicKeyCredential.h, PublicKeyCredential.idl, PublicKeyCredentialDescriptor.idl, PublicKeyCredentialEntity.idl, PublicKeyCredentialParameters.idl, PublicKeyCredentialRequestOptions.idl, PublicKeyCredentialUserEntity.idl, WebAuthenticationClient.cpp, WebAuthenticationClient.h, with the same CrashedComponent(UI>Browser>Passwords) as WebAuthenticationClient.cpp (in frame#0), CredentialsContainer.cpp (in frame#2), CredentialManagerClient.cpp (in frame#1) @kpaulhamus -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes. Thank You.
,
Oct 12 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/c8ba1cde0f827475cb3dc75789b198c681753c24 commit c8ba1cde0f827475cb3dc75789b198c681753c24 Author: Kim Paulhamus <kpaulhamus@chromium.org> Date: Thu Oct 12 20:06:06 2017 Handle nullable rpIds and address TODOs to use typeconverters. This fixes a Null-dereference READ error. Add more tests for unexpected input cases. Bug: 770249 Change-Id: I70161d872ecc4daa406ec56edd60faa11f404e81 Reviewed-on: https://chromium-review.googlesource.com/704192 Commit-Queue: Kim Paulhamus <kpaulhamus@chromium.org> Reviewed-by: Balazs Engedy <engedy@chromium.org> Reviewed-by: Daniel Cheng <dcheng@chromium.org> Cr-Commit-Position: refs/heads/master@{#508418} [modify] https://crrev.com/c8ba1cde0f827475cb3dc75789b198c681753c24/content/browser/webauth/authenticator_impl.cc [modify] https://crrev.com/c8ba1cde0f827475cb3dc75789b198c681753c24/third_party/WebKit/LayoutTests/http/tests/credentialmanager/credentialscontainer-create-basics.html [modify] https://crrev.com/c8ba1cde0f827475cb3dc75789b198c681753c24/third_party/WebKit/Source/modules/credentialmanager/WebAuthenticationClient.cpp [modify] https://crrev.com/c8ba1cde0f827475cb3dc75789b198c681753c24/third_party/WebKit/public/platform/modules/webauth/authenticator.mojom
,
Oct 13 2017
ClusterFuzz has detected this issue as fixed in range 508393:508470. Detailed report: https://clusterfuzz.com/testcase?key=4709890370306048 Fuzzer: inferno_twister Job Type: mac_asan_chrome Platform Id: mac Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: blink::WebAuthenticationClient::DispatchMakeCredential blink::CredentialManagerClient::DispatchMakeCredential blink::CredentialsContainer::create Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=496355:496450 Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=508393:508470 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4709890370306048 Additional requirements: Requires HTTP See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Oct 13 2017
,
Oct 13 2017
ClusterFuzz testcase 4709890370306048 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Nov 7 2017
|
||||||
►
Sign in to add a comment |
||||||
Comment 1 by ClusterFuzz
, Oct 1 2017