New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 892026 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Oct 5
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security



Sign in to add a comment

Crash in AtomicallySetQuarantineFlagIfAllocated

Project Member Reported by ClusterFuzz, Oct 4

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6615545468944384

Fuzzer: libFuzzer_packet_buffer_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: UNKNOWN WRITE
Crash Address: 0xffffffffffffffef
Crash State:
  AtomicallySetQuarantineFlagIfAllocated
  webrtc::RtpGenericFrameDescriptor::~RtpGenericFrameDescriptor
  absl::optional_internal::optional_data_dtor_base<webrtc::RtpGenericFrameDescript
  
Sanitizer: address (ASAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=595906:595916

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6615545468944384

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Oct 4

Cc: kwiberg@webrtc.org mflodman@webrtc.org henrika@webrtc.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 2 by ClusterFuzz, Oct 4

Cc: philipel@webrtc.org
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Make RtpGenericFrameDescriptor available for E2EE. by philipel@webrtc.org - https://webrtc.googlesource.com/src/+/2837edce997b469a702bb96f84ac49dfb727531d

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 3 by sheriffbot@chromium.org, Oct 4

Labels: Target-71 M-71
Project Member

Comment 4 by sheriffbot@chromium.org, Oct 4

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 5 by sheriffbot@chromium.org, Oct 4

Labels: Pri-1
I can download the test case but not see the details of the crash (no permissions). I can't reproduce the crash on ToT.
Ran the repro steps found in the details of the crash, and it has not yet caught up with WebRTC ToT. The fix landed here solves this problem: https://webrtc-review.googlesource.com/c/src/+/103462

This is not a crash in production code, just in fuzzing.

I can't set this bug to "fixed" though since I can't access it from my @chromium account for some reason.
Project Member

Comment 8 by ClusterFuzz, Oct 5

ClusterFuzz has detected this issue as fixed in range 596655:596661.

Detailed report: https://clusterfuzz.com/testcase?key=6615545468944384

Fuzzer: libFuzzer_packet_buffer_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: UNKNOWN WRITE
Crash Address: 0xffffffffffffffef
Crash State:
  AtomicallySetQuarantineFlagIfAllocated
  webrtc::RtpGenericFrameDescriptor::~RtpGenericFrameDescriptor
  absl::optional_internal::optional_data_dtor_base<webrtc::RtpGenericFrameDescript
  
Sanitizer: address (ASAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=595906:595916
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=596655:596661

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6615545468944384

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Oct 5

Labels: ClusterFuzz-Verified
Status: Verified (was: Untriaged)
ClusterFuzz testcase 6615545468944384 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Owner: philipel@chromium.org
Project Member

Comment 11 by sheriffbot@chromium.org, Oct 5

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Labels: -ReleaseBlock-Stable
Project Member

Comment 13 by sheriffbot@chromium.org, Jan 11

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment