New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 770249 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Oct 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Android , Mac
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in blink::WebAuthenticationClient::DispatchMakeCredential

Project Member Reported by ClusterFuzz, Sep 29 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4709890370306048

Fuzzer: inferno_twister
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  blink::WebAuthenticationClient::DispatchMakeCredential
  blink::CredentialManagerClient::DispatchMakeCredential
  blink::CredentialsContainer::create
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=496355:496450

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4709890370306048

Additional requirements: Requires HTTP

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Oct 1 2017

Labels: OS-Android
Project Member

Comment 2 by ClusterFuzz, Oct 1 2017

Components: UI>Browser>Passwords
Labels: Test-Predator-AutoComponents
Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: msrchandra@chromium.org pnangunoori@chromium.org
Labels: M-63 Test-Predator-Correct
Owner: kpaulhamus@chromium.org
Status: Assigned (was: Untriaged)
Test Predator has given the following results:

Initial upload to reland 578729. by kpaulhamus@chromium.org
Changelist touched lines near the crashed line in frame #0 blink::WebAuthenticationClient::DispatchMakeCredential(blink::MakeCredentialOptions const&, std::__1::unique_ptr<blink::WebCallbacks<mojo::StructPtr<webauth::mojom::blink::PublicKeyCredentialInfo>, blink::WebCredentialManagerError>, std::__1::default_delete<blink::WebCallbacks<mojo::StructPtr<webauth::mojom::blink::PublicKeyCredentialInfo>, blink::WebCredentialManagerError> > >) (distance = 0 lines away)
Top touched frame is #0 blink::WebAuthenticationClient::DispatchMakeCredential(in WebAuthenticationClient.cpp)
Changed files credentialscontainer-create-basics.html, mock-authenticator.html, AuthenticatorAssertionResponse.cpp, AuthenticatorAssertionResponse.h, AuthenticatorAssertionResponse.idl, AuthenticatorAttestationResponse.cpp, AuthenticatorAttestationResponse.h, AuthenticatorAttestationResponse.idl, AuthenticatorResponse.cpp, AuthenticatorResponse.h, AuthenticatorResponse.idl, AuthenticatorSelectionCriteria.idl, BUILD.gn, CollectedClientData.idl, CredentialCreationOptions.idl, CredentialManagerClient.cpp, CredentialManagerClient.h, CredentialRequestOptions.idl, CredentialsContainer.cpp, MakeCredentialOptions.idl, PublicKeyCredential.cpp, PublicKeyCredential.h, PublicKeyCredential.idl, PublicKeyCredentialDescriptor.idl, PublicKeyCredentialEntity.idl, PublicKeyCredentialParameters.idl, PublicKeyCredentialRequestOptions.idl, PublicKeyCredentialUserEntity.idl, WebAuthenticationClient.cpp, WebAuthenticationClient.h, with the same CrashedDirectory(third_party/WebKit/Source/modules/credentialmanager) as WebAuthenticationClient.cpp (in frame#0), CredentialsContainer.cpp (in frame#2), CredentialManagerClient.cpp (in frame#1)
Touched files in stacktrace - WebAuthenticationClient.cpp, CredentialsContainer.cpp, CredentialManagerClient.cpp
Changed files credential_manager_browsertest.cc, AuthenticatorAssertionResponse.cpp, AuthenticatorAssertionResponse.h, AuthenticatorAssertionResponse.idl, AuthenticatorAttestationResponse.cpp, AuthenticatorAttestationResponse.h, AuthenticatorAttestationResponse.idl, AuthenticatorResponse.cpp, AuthenticatorResponse.h, AuthenticatorResponse.idl, AuthenticatorSelectionCriteria.idl, BUILD.gn, CollectedClientData.idl, CredentialCreationOptions.idl, CredentialManagerClient.cpp, CredentialManagerClient.h, CredentialRequestOptions.idl, CredentialsContainer.cpp, MakeCredentialOptions.idl, PublicKeyCredential.cpp, PublicKeyCredential.h, PublicKeyCredential.idl, PublicKeyCredentialDescriptor.idl, PublicKeyCredentialEntity.idl, PublicKeyCredentialParameters.idl, PublicKeyCredentialRequestOptions.idl, PublicKeyCredentialUserEntity.idl, WebAuthenticationClient.cpp, WebAuthenticationClient.h, with the same CrashedComponent(UI>Browser>Passwords) as WebAuthenticationClient.cpp (in frame#0), CredentialsContainer.cpp (in frame#2), CredentialManagerClient.cpp (in frame#1)

@kpaulhamus -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes.

Thank You.
Project Member

Comment 5 by ClusterFuzz, Oct 13 2017

ClusterFuzz has detected this issue as fixed in range 508393:508470.

Detailed report: https://clusterfuzz.com/testcase?key=4709890370306048

Fuzzer: inferno_twister
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  blink::WebAuthenticationClient::DispatchMakeCredential
  blink::CredentialManagerClient::DispatchMakeCredential
  blink::CredentialsContainer::create
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=496355:496450
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=508393:508470

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4709890370306048

Additional requirements: Requires HTTP

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Comment 6 by battre@chromium.org, Oct 13 2017

Status: Fixed (was: Assigned)
Project Member

Comment 7 by ClusterFuzz, Oct 13 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 4709890370306048 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components

Sign in to add a comment