New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 788564 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Closed: Dec 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac , Fuchsia
Pri: 1
Type: Bug-Security



Sign in to add a comment

Heap-use-after-free in test_runner::WebWidgetTestClient::AnimateNow

Project Member Reported by ClusterFuzz, Nov 26 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5136234300309504

Fuzzer: ochang_domfuzzer
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Heap-use-after-free READ 8
Crash Address: 0x617000049c00
Crash State:
  test_runner::WebWidgetTestClient::AnimateNow
  blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue
  blink::scheduler::TaskQueueManager::DoWork
  
Sanitizer: address (ASAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=502225:502253

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5136234300309504

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 26 2017

Components: Blink>Scheduling Internals>Core
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by sheriffbot@chromium.org, Nov 27 2017

Labels: M-64
Project Member

Comment 3 by sheriffbot@chromium.org, Nov 27 2017

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 4 by sheriffbot@chromium.org, Nov 27 2017

Labels: Pri-1
Cc: lukasza@chromium.org dcheng@chromium.org lfg@chromium.org
Status: Available (was: Untriaged)
Add a couple of ppl to cc to help triage this issue. 

Comment 6 by palmer@chromium.org, Nov 28 2017

Cc: alexclarke@chromium.org
Labels: OS-Android OS-Chrome OS-Fuchsia OS-Mac OS-Windows
Owner: lukasza@chromium.org
Status: Assigned (was: Available)
+alexclarke, who has worked on TaskQueueManager::ProcessTaskFromWorkQueue.

If this bug is only in the test runner, we can remove the security labels. But if the test runner is tickling a bug in Blink, then we have a real security bug.
Project Member

Comment 8 by sheriffbot@chromium.org, Dec 7 2017

Labels: -Security_Impact-Head Security_Impact-Beta
Project Member

Comment 9 by sheriffbot@chromium.org, Dec 11 2017

lukasza: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 10 by lfg@chromium.org, Dec 11 2017

Labels: -Security_Severity-High -Security_Impact-Beta -ReleaseBlock-Stable Security_Impact-None
I haven't been able to reproduce locally, but I think this is a bug. The WebViewFrameWidget gets destroyed in RenderViewImpl::Close(), and then gets de-referenced in WebWidgetTestClient::AnimateNow. This is likely a race, since the WebViewImpl is also closed RenderViewImpl::Close(), and the task is posted with a weak ptr to the WebViewImpl. The WebViewImpl must be closed between posting the task and executing it, and there must be something holding a strong reference to the WebViewImpl.

We probably need to track the closing of the RenderViewImpl and null the WebViewFrameWidget somewhere, similar to how we set it on RenderViewCreated.

Either way, this shouldn't be a security issue, as it would be test-only.
Project Member

Comment 11 by ClusterFuzz, Dec 22 2017

Status: WontFix (was: Assigned)
ClusterFuzz testcase 5136234300309504 is flaky and no longer crashes, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 12 by sheriffbot@chromium.org, Mar 30 2018

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment