New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 795501 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Dec 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 0
Type: Bug-Security



Sign in to add a comment

Container-overflow in content::AudioStreamMonitor::UpdateStreamAudibleStateOnUIThread

Project Member Reported by ClusterFuzz, Dec 16 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6597335768629248

Fuzzer: phoglund_webrtc_peerconnection
Job Type: linux_asan_chrome_chromeos
Platform Id: linux

Crash Type: Container-overflow WRITE 1
Crash Address: 0x60600099280c
Crash State:
  content::AudioStreamMonitor::UpdateStreamAudibleStateOnUIThread
  base::MessageLoop::RunTask
  base::MessageLoop::DoWork
  
Sanitizer: address (ASAN)

Recommended Security Severity: Critical

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6597335768629248

Additional requirements: Requires HTTP

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.

Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. We will auto-close the bug if the crash is not seen for 14 days.
 
Project Member

Comment 1 by ClusterFuzz, Dec 16 2017

Components: Internals>Core
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by sheriffbot@chromium.org, Dec 16 2017

Labels: Pri-0

Comment 3 by cthomp@chromium.org, Dec 16 2017

Cc: maxmorin@chromium.org olka@chromium.org
Components: Internals>Media
Owner: guidou@chromium.org
Status: Unconfirmed (was: Untriaged)
This is potentially memory corruption in the browser process, which is why clusterfuzz has marked this as criticial.

Clusterfuzz shows this as not-reproducible, but that may be due to the media requirements (I'm not sure ClusterFuzz can set up webcams/microphones). I'm checking to see if I can reproduce it in a desktop ASAN chromium build.

guidou@ It looks like you recently made substantial changes to content/browser/media/audio_stream_monitor.cc, where this crash appears to be happening. Could you please investigate this or assign this to someone who can?

Also CCing the owners of content/browser/media in case they can help triage this further.
Project Member

Comment 4 by sheriffbot@chromium.org, Dec 17 2017

Status: Assigned (was: Unconfirmed)

Comment 5 by guidou@chromium.org, Dec 18 2017

Will take a look today.

Comment 6 by guidou@chromium.org, Dec 18 2017

Could not reproduce, but made a patch based on the stack trace.
https://chromium-review.googlesource.com/c/chromium/src/+/832186
Project Member

Comment 7 by bugdroid1@chromium.org, Dec 18 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/73481a5e48cd42d72d89beb6d1fca3847927cb53

commit 73481a5e48cd42d72d89beb6d1fca3847927cb53
Author: Guido Urdaneta <guidou@chromium.org>
Date: Mon Dec 18 16:07:12 2017

Update AudioStreamMonitor to handle updates to nonexistent streams

A crash has been reported where apparently it is possible for
a state update to arrive for a stream after the stream has been
removed.

This CL makes AudioStreamMonitor handle this case instead of DCHECKing.

Bug:  795501 
Change-Id: Id43c3c4a846af5d8e7d1d387d36ed31e45724ad8
Reviewed-on: https://chromium-review.googlesource.com/832186
Reviewed-by: Olga Sharonova <olka@chromium.org>
Commit-Queue: Guido Urdaneta <guidou@chromium.org>
Cr-Commit-Position: refs/heads/master@{#524719}
[modify] https://crrev.com/73481a5e48cd42d72d89beb6d1fca3847927cb53/content/browser/media/audio_stream_monitor.cc

Comment 8 by guidou@chromium.org, Dec 18 2017

Status: Fixed (was: Assigned)

Comment 9 by awhalley@google.com, Dec 18 2017

Cc: awhalley@chromium.org
guidou@ - thanks for the super fast fix! Do you suspect this bug exists in Stable?
No. This is only in M65.
Project Member

Comment 11 by sheriffbot@chromium.org, Dec 19 2017

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 12 by sheriffbot@chromium.org, Mar 27 2018

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment