New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 820806 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Mar 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in blink::V8RTCCertificate::expiresAttributeGetterCallback

Project Member Reported by ClusterFuzz, Mar 11 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4746274860171264

Fuzzer: inferno_twister
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000008
Crash State:
  blink::V8RTCCertificate::expiresAttributeGetterCallback
  v8::internal::FunctionCallbackArguments::Call
  v8::internal::MaybeHandle<v8::internal::Object> v8::internal::HandleApiCallHelpe
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=523898:523900

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4746274860171264

Additional requirements: Requires HTTP

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Mar 11 2018

Components: Blink>JavaScript
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Components: -Blink>JavaScript Blink>WebRTC>Network Internals>Network>SSL
Labels: Test-Predator-Wrong-Components
Looks like an openssl issue, triggered from webrtc:

[1:18:0312/114856.694468:ERROR:opensslidentity.cc(54)] Failed to make RSA key pair
[1:18:0312/114856.694666:ERROR:opensslidentity.cc(160)] Generating key pair: error:0400008d:RSA routines:OPENSSL_internal:TOO_MANY_ITERATIONS

No, this is a WebRTC bug, not an OpenSSL/BoringSSL one.

The fuzzer asked for an even-exponent RSA key, which is impossible. (TOO_MANY_ITERATIONS comes from us trying to find a large prime where gcd(p-1, e) = 1 and giving up. If e is even, this is impossible.) It was a mistake that WebRTC lets one configure the RSA public exponent at all, but so it goes. (RSA key generation is also probabilistic and will fail with very small probability for sensible public exponents too.)

If this is crashing, that means WebRTC's error-handling is wrong.
Components: -Internals>Network>SSL
And here's the WebRTC bug:
https://cs.chromium.org/chromium/src/content/renderer/media/webrtc/rtc_certificate_generator.cc?rcl=fe2035ca9c5d0a1d17e26fe8b7fa953dc20a7fe2&l=82

Although DoCallbackOnMainThread, it checks whether the content::RTCCertificate wrapper object is null, not the underlying rtc::RTCCertificate. GenerateCertificateOnWorkerThread needs to conditionally create the former based on the latter.
Owner: deadbeef@chromium.org
Status: Started (was: Untriaged)
Thanks for finding that David! I'll go ahead and fix it.
Project Member

Comment 7 by bugdroid1@chromium.org, Mar 13 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4cc07b0dd9beb54bf0735065cd27edb04e585fdc

commit 4cc07b0dd9beb54bf0735065cd27edb04e585fdc
Author: Taylor Brandstetter <deadbeef@chromium.org>
Date: Tue Mar 13 15:48:07 2018

Avoid dereferencing null pointer if generateCertificate fails.

Bug:  chromium:820806 
Change-Id: I36340c31ee6c5c88a4049d346ed9af9dbff43392
Reviewed-on: https://chromium-review.googlesource.com/959525
Reviewed-by: Henrik Boström <hbos@chromium.org>
Commit-Queue: Henrik Boström <hbos@chromium.org>
Cr-Commit-Position: refs/heads/master@{#542812}
[modify] https://crrev.com/4cc07b0dd9beb54bf0735065cd27edb04e585fdc/content/renderer/media/webrtc/rtc_certificate_generator.cc

Project Member

Comment 8 by ClusterFuzz, Mar 14 2018

ClusterFuzz has detected this issue as fixed in range 542811:542812.

Detailed report: https://clusterfuzz.com/testcase?key=4746274860171264

Fuzzer: inferno_twister
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000008
Crash State:
  blink::V8RTCCertificate::expiresAttributeGetterCallback
  v8::internal::FunctionCallbackArguments::Call
  v8::internal::MaybeHandle<v8::internal::Object> v8::internal::HandleApiCallHelpe
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=523898:523900
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=542811:542812

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4746274860171264

Additional requirements: Requires HTTP

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Mar 14 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 4746274860171264 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment