New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 770542 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Closed: Oct 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Direct-leak in blink::SourceLocation::Create

Project Member Reported by ClusterFuzz, Oct 1 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6114961272340480

Fuzzer: afl_content_security_policy_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  blink::SourceLocation::Create
  blink::Document::AddConsoleMessage
  blink::ContentSecurityPolicy::ApplyPolicySideEffectsToExecutionContext
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=463138:463141

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6114961272340480

Additional requirements: Requires Gestures

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org pnangunoori@chromium.org
Labels: M-61 Test-Predator-Wrong
Owner: kinuko@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using the code search for the file, “ContentSecurityPolicy.cpp” assigning to concern owner from GIT blame.
Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/ebd1c7d184fd1979b0eb0590665fe2695fc353f7
@kinuko -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes.
Thank You.

Cc: andypaicu@chromium.org mkwst@chromium.org kinuko@chromium.org
Components: Blink>SecurityFeature>ContentSecurityPolicy
Owner: ----
Status: Untriaged (was: Assigned)
I can't really see how my change could have caused the issue. blink::SourceLocation::Create creates a SourceLocation as a unique ptr and passes it to the execution context's ConsoleMessageStorage, so the execution context is the one that's probably leaking?

Adding some more CSP people to get more eyes on it, I actually have no idea.

> See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

This link seems dead?
Owner: jbroman@chromium.org
Status: Assigned (was: Untriaged)
As per the  Issue 703862  owner assigning this issue to @jbroman.
@jbroman -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes.
Thanks.
Cc: mmoroz@chromium.org
Status: WontFix (was: Assigned)
cc mmoroz in case there's a better way to suppress this

This is allocated in the global initialization, and intentionally leaked (per the recommendations).
Project Member

Comment 5 by ClusterFuzz, Oct 3 2017

Components: Blink>Bindings Blink>DOM
Labels: Test-Predator-AutoComponents
Automatically applying components based on crash stacktrace and information from OWNERS files. If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components

Sign in to add a comment