New issue
Advanced search Search tips

Issue 884044 link

Starred by 2 users

Issue metadata

Status: WontFix
Owner:
Closed: Oct 14
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 1
Type: Bug-Security



Sign in to add a comment

Heap-use-after-free in gpu::CommandBufferProxyImpl::DisconnectChannel

Project Member Reported by ClusterFuzz, Sep 14

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5152694071984128

Fuzzer: ochang_media2
Job Type: linux_asan_chrome_media
Platform Id: linux

Crash Type: Heap-use-after-free READ 8
Crash Address: 0x619000060078
Crash State:
  gpu::CommandBufferProxyImpl::DisconnectChannel
  gpu::CommandBufferProxyImpl::OnChannelError
  base::debug::TaskAnnotator::RunTask
  
Sanitizer: address (ASAN)

Recommended Security Severity: High

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5152694071984128

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.

Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. We will auto-close the bug if the crash is not seen for 14 days.
 
Project Member

Comment 1 by ClusterFuzz, Sep 14

Labels: OS-Mac
Project Member

Comment 2 by ClusterFuzz, Sep 14

Labels: Fuzz-Blocker ReleaseBlock-Beta M-71
This crash occurs very frequently on mac platform and is likely preventing the fuzzer ochang_media2 from making much progress. Fixing this will allow more bugs to be found.

Marking this bug as a blocker for next Beta release.

If this is incorrect, please add ClusterFuzz-Wrong label and remove the ReleaseBlock-Beta label.
Project Member

Comment 3 by ClusterFuzz, Sep 14

Components: Internals>Core Internals>TaskScheduler
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 4 by sheriffbot@chromium.org, Sep 14

Labels: Security_Impact-Head
Project Member

Comment 5 by sheriffbot@chromium.org, Sep 14

Labels: Pri-1
Owner: sadrul@chromium.org
Status: Assigned (was: Untriaged)
sadrul: Can you take a look at this? It looks like a lifetime issue with the GpuChannelHost.
Components: -Internals>TaskScheduler
Project Member

Comment 8 by sheriffbot@chromium.org, Sep 28

sadrul: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
sadrul: Friendly ping from security sheriff, have you had a chance to look at this bug?
Project Member

Comment 10 by sheriffbot@chromium.org, Oct 13

sadrul: Uh oh! This issue still open and hasn't been updated in the last 29 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Status: Started (was: Assigned)
Project Member

Comment 12 by ClusterFuzz, Oct 14

Status: WontFix (was: Started)
ClusterFuzz testcase 5152694071984128 is flaky and no longer crashes, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 13 by sheriffbot@chromium.org, Yesterday (42 hours ago)

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment