Issue metadata
Sign in to add a comment
|
Heap-use-after-free in base::MessageLoop::DeletePendingTasks |
||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5265605691965440 Fuzzer: attekett_webaudio_fuzzer Job Type: linux_asan_chrome_chromeos Platform Id: linux Crash Type: Heap-use-after-free WRITE 4 Crash Address: 0x6140004f6308 Crash State: base::MessageLoop::DeletePendingTasks base::MessageLoop::~MessageLoop base::MessageLoopForUI::~MessageLoopForUI Sanitizer: address (ASAN) Recommended Security Severity: Critical Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5265605691965440 Additional requirements: Requires Gestures Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information. Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. We will auto-close the bug if the crash is not seen for 14 days.
,
Aug 12
Automatically applying components based on crash stacktrace and information from OWNERS files. If this is incorrect, please apply the Test-Predator-Wrong-Components label.
,
Aug 13
,
Aug 13
,
Aug 13
Hmm, this is a flaky one not always reproducible in each run. Stacktraces are hard to interpret. It seems the error happens on the following line: [24059:24059:0811/052008.709399:ERROR:sandbox_linux.cc(379)] InitializeSandbox() called with multiple threads in process gpu-process.
,
Aug 14
,
Aug 14
,
Aug 15
This is a critical security issue. If you are not able to fix this quickly, please revert the change that introduced it. If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Aug 15
Looks like this is caused by a call from CloudPrint, thestig, can you take a look (and reassign if appropriate)?
,
Aug 15
Is this really a P0? I have some ideas for simplifying PrivetTrafficDetector to make its lifetime saner. e.g. not be: base::RefCountedThreadSafe<PrivetTrafficDetector, content::BrowserThread::DeleteOnIOThread> Maybe that will help...
,
Aug 15
+rmcelrath FYI.
,
Aug 16
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/10f13475d328718cba6149d14f377fbf92ae4c68 commit 10f13475d328718cba6149d14f377fbf92ae4c68 Author: Lei Zhang <thestig@chromium.org> Date: Thu Aug 16 21:10:08 2018 Make PrivetTrafficDetector live on the UI thread. Split all IO thread code into a separate helper class. Now there is no refcounting, so ownership is clearer. Now only the helper class has a WeakPtrFactory, so WeakPtrs are only used on the IO thread. BUG= 873529 Change-Id: I326aa6f69839c193507df4c63250aa1560bbd0ef Reviewed-on: https://chromium-review.googlesource.com/1177444 Commit-Queue: Lei Zhang <thestig@chromium.org> Reviewed-by: Robbie McElrath <rmcelrath@chromium.org> Cr-Commit-Position: refs/heads/master@{#583813} [modify] https://crrev.com/10f13475d328718cba6149d14f377fbf92ae4c68/chrome/browser/printing/cloud_print/privet_notifications.cc [modify] https://crrev.com/10f13475d328718cba6149d14f377fbf92ae4c68/chrome/browser/printing/cloud_print/privet_notifications.h [modify] https://crrev.com/10f13475d328718cba6149d14f377fbf92ae4c68/chrome/browser/printing/cloud_print/privet_traffic_detector.cc [modify] https://crrev.com/10f13475d328718cba6149d14f377fbf92ae4c68/chrome/browser/printing/cloud_print/privet_traffic_detector.h
,
Aug 16
Given CF marked the bug as unreproducible, it is hard to say if my CL actually fixed this issue. I'd like to think it does.
,
Aug 17
,
Aug 27
(found by many, including internal, fuzzers)
,
Aug 28
,
Nov 23
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by ClusterFuzz
, Aug 12