https://logs.chromium.org/v/?s=chromium%2Fbb%2Ftryserver.chromium.win%2Fwin10_chromium_x64_rel_ng%2F94014%2F%2B%2Frecipes%2Fsteps%2Fcrashpad_tests__with_patch__on_Windows-10-14393%2F0%2Flogs%2FCrashpadClient.HandlerLaunchFailureDumpWithoutCrash%2F0 shows:
logging::LogMessage::~LogMessage [0x00007FF611097EB3+99]
base::BasicStringPiece<std::basic_string<char,std::char_traits<char>,std::allocator<char> > >::operator[] [0x00007FF610F5CD61+81]
crashpad::StringToNumber [0x00007FF611127FEF+95]
crashpad::test::WinChildProcess::WinChildProcess [0x00007FF6111329BA+298]
The relevant code seems to be:
if (string[string.length()] != '\0') {
// The implementations use the C standard library’s conversion routines,
// which rely on the strings having a trailing NUL character. std::string
// will NUL-terminate.
std::string terminated_string(string.data(), string.length());
return StringToIntegerInternal<Traits>(terminated_string, number);
}
in ./third_party/crashpad/crashpad/util/stdlib/string_number_conversion.cc.
(See https://chromium-review.googlesource.com/c/chromium/src/+/945049)
This affects at least macOS and Windows, but maybe other platforms. Although the severity is Low, I'm calling it Pri-1 because I really want to land that CL and get some bounds checking happening. :) If not Mark, can one of the other Crashpad OWNERS take a look? Thanks all!
Comment 1 by mark@chromium.org
, Mar 3 2018