New issue
Advanced search Search tips

Issue 801811 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 797825
Owner:
Closed: Jan 2018
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: !hostname.empty() in x509_certificate.cc

Project Member Reported by ClusterFuzz, Jan 13 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4774918045827072

Fuzzer: libFuzzer_net_quic_stream_factory_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !hostname.empty() in x509_certificate.cc
  net::X509Certificate::VerifyHostname
  net::X509Certificate::VerifyNameMatch
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=520730:520767

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4774918045827072

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jan 13 2018

Components: Internals>Network>Certificate Internals>Network>HTTP2
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jan 13 2018

Labels: Test-Predator-Auto-Owner
Owner: zhongyi@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/f4683a37ef679c4b1ea669855567a7938724389a (Add a different config param to control connection migration v2 on).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
Mergedinto: 797825
Status: Duplicate (was: Assigned)
Labels: Test-Predator-Wrong-CLs
Project Member

Comment 5 by ClusterFuzz, Jan 25 2018

ClusterFuzz has detected this issue as fixed in range 531452:531461.

Detailed report: https://clusterfuzz.com/testcase?key=4774918045827072

Fuzzer: libFuzzer_net_quic_stream_factory_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !hostname.empty() in x509_certificate.cc
  net::X509Certificate::VerifyHostname
  net::X509Certificate::VerifyNameMatch
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=520730:520767
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=531452:531461

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4774918045827072

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Comment 6 by b...@chromium.org, Jan 25 2018

Manual bisect shows that crash is not reproducible with this particular testcase since https://crrev.com/c/833108 landed.  This is not because that change would have fixed the underlying issue, but because it changes how fuzzer data is consumed.
Project Member

Comment 7 by bugdroid1@chromium.org, Feb 1 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7538a95ba14ef8d32fcf34ccf56097a7370e7a9c

commit 7538a95ba14ef8d32fcf34ccf56097a7370e7a9c
Author: Bence Béky <bnc@chromium.org>
Date: Thu Feb 01 16:59:52 2018

Add regression test for QUIC PUSH with empty hostname.

The underlying bug of the three linked issues found by Clusterfuzz is
that if a QUIC PUSH is received with an empty hostname, it used to be
passed on to X509Certificate::VerifyHostname(), where a DCHECK() would
fail.  This has been fixed at https://crrev.com/c/893625 by wangyix.
The current CL is adding a regression test for this.

Note that it has been suggested at  https://crbug.com/797825#c7 
that the connection be terminated (not only the stream reset)
on such a malformed input.

Bug:  788537 ,  797825 ,  801811 
Change-Id: I96bb1528264549ca05e64da914de3f3a70d0f7c4
Reviewed-on: https://chromium-review.googlesource.com/851194
Commit-Queue: Bence Béky <bnc@chromium.org>
Reviewed-by: Ryan Hamilton <rch@chromium.org>
Cr-Commit-Position: refs/heads/master@{#533705}
[modify] https://crrev.com/7538a95ba14ef8d32fcf34ccf56097a7370e7a9c/net/quic/chromium/quic_network_transaction_unittest.cc

Sign in to add a comment