New issue
Advanced search Search tips

Issue 777210 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Closed: Oct 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 1
Type: Bug-Security



Sign in to add a comment

Heap-use-after-free in base::PowerMonitor::NotifyPowerStateChange

Project Member Reported by ClusterFuzz, Oct 22 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5739780997644288

Fuzzer: meacer_extension_apis
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: Heap-use-after-free READ 8
Crash Address: 0x61000002ccd8
Crash State:
  base::PowerMonitor::NotifyPowerStateChange
  device::mojom::PowerMonitorClientStubDispatch::Accept
  mojo::InterfaceEndpointClient::HandleValidatedMessage
  
Sanitizer: address (ASAN)

Recommended Security Severity: High

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5739780997644288

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.

Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. We will auto-close the bug if the crash is not seen for 14 days.
 
Project Member

Comment 1 by sheriffbot@chromium.org, Oct 23 2017

Labels: Pri-1

Comment 2 by tsepez@chromium.org, Oct 23 2017

Owner: blundell@chromium.org
blundell, IIRC you did some work with mojo and power monitors, care to take a look.  Unfortunately, there isn't a lot to go on here.  Thanks.
Project Member

Comment 3 by sheriffbot@chromium.org, Oct 24 2017

Status: Assigned (was: Untriaged)
Status: WontFix (was: Assigned)
Hmm, it looks like the CF test case was deleted here. I'm going to close this out since I doubt it will be actionable, but we can hopefully file a new bug if we hit this crash again.
Project Member

Comment 5 by sheriffbot@chromium.org, Feb 1 2018

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment