New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 826783 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Mar 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security



Sign in to add a comment

Bad-cast to rtc::PacketTransportInternal from content::(anonymous namespace)::IpcPacketSocket in webrtc::RtpTransport::IsTransportWritable

Project Member Reported by ClusterFuzz, Mar 28 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5089904347054080

Fuzzer: phoglund_webrtc_peerconnection
Job Type: linux_ubsan_vptr_chrome
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0x19d2de667600
Crash State:
  Bad-cast to rtc::PacketTransportInternal from content::(anonymous namespace)::IpcPacketSocket
  webrtc::RtpTransport::IsTransportWritable
  webrtc::RtpTransport::OnWritableState
  
Sanitizer: undefined (UBSAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=546384:546391

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5089904347054080

Additional requirements: Requires HTTP

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Mar 28 2018

Cc: zhihuang@webrtc.org
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Reland "Replace BundleFilter with RtpDemuxer in RtpTransport." by zhihuang@webrtc.org - https://webrtc.googlesource.com/src/+/27f3bf512827b483f9e0c67ce76362d83faa1950

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.

Comment 2 by zhihuang@webrtc.org, Mar 28 2018

Fixing CL is out for review:
https://webrtc-review.googlesource.com/c/src/+/65340

Should have the same root cause as: https://bugs.chromium.org/p/chromium/issues/detail?id=826725

Comment 3 by zhihuang@webrtc.org, Mar 29 2018

reverting the original change.
Project Member

Comment 4 by sheriffbot@chromium.org, Mar 29 2018

Labels: M-67
Project Member

Comment 5 by sheriffbot@chromium.org, Mar 29 2018

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 6 by sheriffbot@chromium.org, Mar 29 2018

Labels: Pri-1

Comment 7 by mmoroz@chromium.org, Mar 30 2018

Owner: zhihuang@chromium.org
Status: Assigned (was: Untriaged)

Comment 8 by mmoroz@chromium.org, Mar 30 2018

Components: Blink>WebRTC

Comment 9 by zhihuang@webrtc.org, Mar 30 2018

Should be fixed now. The original CL has been reverted.
Project Member

Comment 10 by ClusterFuzz, Mar 30 2018

ClusterFuzz has detected this issue as fixed in range 546863:546887.

Detailed report: https://clusterfuzz.com/testcase?key=5089904347054080

Fuzzer: phoglund_webrtc_peerconnection
Job Type: linux_ubsan_vptr_chrome
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0x19d2de667600
Crash State:
  Bad-cast to rtc::PacketTransportInternal from content::(anonymous namespace)::IpcPacketSocket
  webrtc::RtpTransport::IsTransportWritable
  webrtc::RtpTransport::OnWritableState
  
Sanitizer: undefined (UBSAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=546384:546391
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=546863:546887

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5089904347054080

Additional requirements: Requires HTTP

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by ClusterFuzz, Mar 30 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5089904347054080 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 12 by sheriffbot@chromium.org, Mar 31 2018

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Labels: -ReleaseBlock-Stable
Project Member

Comment 14 by sheriffbot@chromium.org, Jul 7

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment