Null-dereference READ in blink::V8RTCCertificate::expiresAttributeGetterCallback |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4746274860171264 Fuzzer: inferno_twister Job Type: linux_asan_chrome_mp Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000008 Crash State: blink::V8RTCCertificate::expiresAttributeGetterCallback v8::internal::FunctionCallbackArguments::Call v8::internal::MaybeHandle<v8::internal::Object> v8::internal::HandleApiCallHelpe Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=523898:523900 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4746274860171264 Additional requirements: Requires HTTP Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Mar 12 2018
Looks like an openssl issue, triggered from webrtc: [1:18:0312/114856.694468:ERROR:opensslidentity.cc(54)] Failed to make RSA key pair [1:18:0312/114856.694666:ERROR:opensslidentity.cc(160)] Generating key pair: error:0400008d:RSA routines:OPENSSL_internal:TOO_MANY_ITERATIONS
,
Mar 12 2018
No, this is a WebRTC bug, not an OpenSSL/BoringSSL one. The fuzzer asked for an even-exponent RSA key, which is impossible. (TOO_MANY_ITERATIONS comes from us trying to find a large prime where gcd(p-1, e) = 1 and giving up. If e is even, this is impossible.) It was a mistake that WebRTC lets one configure the RSA public exponent at all, but so it goes. (RSA key generation is also probabilistic and will fail with very small probability for sensible public exponents too.) If this is crashing, that means WebRTC's error-handling is wrong.
,
Mar 12 2018
,
Mar 12 2018
And here's the WebRTC bug: https://cs.chromium.org/chromium/src/content/renderer/media/webrtc/rtc_certificate_generator.cc?rcl=fe2035ca9c5d0a1d17e26fe8b7fa953dc20a7fe2&l=82 Although DoCallbackOnMainThread, it checks whether the content::RTCCertificate wrapper object is null, not the underlying rtc::RTCCertificate. GenerateCertificateOnWorkerThread needs to conditionally create the former based on the latter.
,
Mar 12 2018
Thanks for finding that David! I'll go ahead and fix it.
,
Mar 13 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/4cc07b0dd9beb54bf0735065cd27edb04e585fdc commit 4cc07b0dd9beb54bf0735065cd27edb04e585fdc Author: Taylor Brandstetter <deadbeef@chromium.org> Date: Tue Mar 13 15:48:07 2018 Avoid dereferencing null pointer if generateCertificate fails. Bug: chromium:820806 Change-Id: I36340c31ee6c5c88a4049d346ed9af9dbff43392 Reviewed-on: https://chromium-review.googlesource.com/959525 Reviewed-by: Henrik Boström <hbos@chromium.org> Commit-Queue: Henrik Boström <hbos@chromium.org> Cr-Commit-Position: refs/heads/master@{#542812} [modify] https://crrev.com/4cc07b0dd9beb54bf0735065cd27edb04e585fdc/content/renderer/media/webrtc/rtc_certificate_generator.cc
,
Mar 14 2018
ClusterFuzz has detected this issue as fixed in range 542811:542812. Detailed report: https://clusterfuzz.com/testcase?key=4746274860171264 Fuzzer: inferno_twister Job Type: linux_asan_chrome_mp Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000008 Crash State: blink::V8RTCCertificate::expiresAttributeGetterCallback v8::internal::FunctionCallbackArguments::Call v8::internal::MaybeHandle<v8::internal::Object> v8::internal::HandleApiCallHelpe Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=523898:523900 Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=542811:542812 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4746274860171264 Additional requirements: Requires HTTP See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Mar 14 2018
ClusterFuzz testcase 4746274860171264 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, Mar 11 2018Labels: Test-Predator-Auto-Components