New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 839194 link

Starred by 1 user

Issue metadata

Status: Fixed
Merged: issue 839197
Owner:
OOO until 4th Feb
Closed: May 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug
Team-Security-UX



Sign in to add a comment

Null-dereference READ in PermissionContextBase::IsPermissionKillSwitchOn

Project Member Reported by ClusterFuzz, May 3 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4762597086461952

Fuzzer: mojo_fuzzer
Job Type: linux_asan_chrome_mojo
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000010
Crash State:
  PermissionContextBase::IsPermissionKillSwitchOn
  PermissionContextBase::GetPermissionStatus
  PermissionManager::GetPermissionStatusHelper
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mojo&range=555295:555297

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4762597086461952

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, May 3 2018

Components: Internals>Permissions
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: pnangunoori@chromium.org
Labels: M-68 Test-Predator-Wrong
Owner: raymes@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using the code search for the file, “permission_manager.cc” assigning to concern owner from GIT revision log.
Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/4ead6c35d84fcb312402a0ad5984cb44021b524e

@raymes -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes.
Thank You.
Components: -Internals>Permissions Internals>Permissions>Model
Mergedinto: 839197
Status: Duplicate (was: Assigned)
Pretty sure this is the same root cause as  issue 839197 

Comment 5 by raymes@chromium.org, May 10 2018

Status: Assigned (was: Duplicate)
Not the same as  issue 839197 

Comment 6 by raymes@chromium.org, May 10 2018

Cc: raymes@chromium.org
 Issue 839220  has been merged into this issue.
Project Member

Comment 7 by bugdroid1@chromium.org, May 10 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/47df4b2c0b9dd21416767c0b31a824435a75e9b1

commit 47df4b2c0b9dd21416767c0b31a824435a75e9b1
Author: Raymes Khoury <raymes@chromium.org>
Date: Thu May 10 04:30:17 2018

Fix 2 nullptr dereferences in permissions code

This fixes 2 nullptr dereferences. The first arises because we don't
sanity check the permission type received in the PermissionService. We
don't expect to receive protected media requests on non-android
platforms so a check is added for that.

The second is because the default implementation of ResetPermission in
PermissionContextBase won't work for content settings types which don't
have a registered ContentSettingsType. We add a check for that case
before resetting the permission.

Bug:  839194 ,  839221 
Change-Id: I0dbb9930a7cc5e459b99e8f937791846fd0db83b
Reviewed-on: https://chromium-review.googlesource.com/1045962
Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Reviewed-by: Timothy Loh <timloh@chromium.org>
Commit-Queue: Raymes Khoury <raymes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#557450}
[modify] https://crrev.com/47df4b2c0b9dd21416767c0b31a824435a75e9b1/chrome/browser/permissions/permission_context_base.cc
[modify] https://crrev.com/47df4b2c0b9dd21416767c0b31a824435a75e9b1/content/browser/bad_message.h
[modify] https://crrev.com/47df4b2c0b9dd21416767c0b31a824435a75e9b1/content/browser/permissions/permission_service_context.h
[modify] https://crrev.com/47df4b2c0b9dd21416767c0b31a824435a75e9b1/content/browser/permissions/permission_service_impl.cc
[modify] https://crrev.com/47df4b2c0b9dd21416767c0b31a824435a75e9b1/content/browser/permissions/permission_service_impl.h
[modify] https://crrev.com/47df4b2c0b9dd21416767c0b31a824435a75e9b1/tools/metrics/histograms/enums.xml

Comment 8 by raymes@chromium.org, May 10 2018

Status: Fixed (was: Assigned)
Project Member

Comment 9 by ClusterFuzz, May 10 2018

ClusterFuzz has detected this issue as fixed in range 557449:557450.

Detailed report: https://clusterfuzz.com/testcase?key=4762597086461952

Fuzzer: mojo_fuzzer
Job Type: linux_asan_chrome_mojo
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000010
Crash State:
  PermissionContextBase::IsPermissionKillSwitchOn
  PermissionContextBase::GetPermissionStatus
  PermissionManager::GetPermissionStatusHelper
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mojo&range=555295:555297
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mojo&range=557449:557450

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4762597086461952

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment