New issue
Advanced search Search tips

Issue 865809 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jul 25
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Abrt in quic::QuicSession::SendRstStream

Project Member Reported by ClusterFuzz, Jul 20

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5327808134643712

Fuzzer: libFuzzer_net_quic_stream_factory_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x05390000596d
Crash State:
  quic::QuicSession::SendRstStream
  net::QuicChromiumClientSession::SendRstStream
  quic::QuicSpdyClientSessionBase::ResetPromised
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=531452:531461

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5327808134643712

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jul 20

Components: Internals>Network>QUIC
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jul 20

Labels: Test-Predator-Auto-Owner
Owner: kapishnikov@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/7f8dd1e122d3c6568768b42adc405cea866fdb11 (Optimize UDPSocketPosix::InternalRecvFrom()).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Owner: rch@chromium.org
[->rch]:  Same issue as the other one, I assume.
(And no, seeing the description of the other issue, I assume it's completely unrelated)
Labels: -Pri-1 Pri-2
Heh, yeah different :) I've sent out an internal CL which fixes this bug and it should land soon and get merged next week. Thankfully, this is very benign issue so I'm lowering the priority.
Project Member

Comment 6 by bugdroid1@chromium.org, Jul 24

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9a6ff125c883080cd6290be1cb5b9dbb072c49e1

commit 9a6ff125c883080cd6290be1cb5b9dbb072c49e1
Author: Ryan Hamilton <rch@chromium.org>
Date: Tue Jul 24 18:37:59 2018

Close the QUIC connection if a server promises to push a response on a client-initiated stream id.

Merge internal change 205691599.

BUG= 865809 

Change-Id: I0369074ac0c1e754cc350c37a47681101e35cf12
Reviewed-on: https://chromium-review.googlesource.com/1148640
Reviewed-by: Zhongyi Shi <zhongyi@chromium.org>
Commit-Queue: Zhongyi Shi <zhongyi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#577620}
[modify] https://crrev.com/9a6ff125c883080cd6290be1cb5b9dbb072c49e1/net/third_party/quic/core/http/quic_spdy_client_session_base.cc
[modify] https://crrev.com/9a6ff125c883080cd6290be1cb5b9dbb072c49e1/net/third_party/quic/core/http/quic_spdy_client_session_test.cc

Project Member

Comment 7 by ClusterFuzz, Jul 25

ClusterFuzz has detected this issue as fixed in range 577618:577620.

Detailed report: https://clusterfuzz.com/testcase?key=5327808134643712

Fuzzer: libFuzzer_net_quic_stream_factory_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x05390000596d
Crash State:
  quic::QuicSession::SendRstStream
  net::QuicChromiumClientSession::SendRstStream
  quic::QuicSpdyClientSessionBase::ResetPromised
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=531452:531461
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=577618:577620

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5327808134643712

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Jul 25

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5327808134643712 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment