Null-dereference READ in extensions::EventsEventRemoveRulesFunction::RunAsyncOnCorrectThread |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5358229468741632 Fuzzer: ipc_fuzzer_mut Job Type: linux_asan_chrome_ipc Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000198 Crash State: extensions::EventsEventRemoveRulesFunction::RunAsyncOnCorrectThread base::internal::Invoker<base::internal::BindState<std::__1::unique_ptr<Extension void base::internal::ReturnAsParamAdapter<std::__1::unique_ptr<ExtensionFunction Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_ipc&range=548504:548506 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5358229468741632 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Nov 4
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/716e18423192709f88bce7766532ef4963c66508 ([Extensions] declarative API function -> UIThreadExtensionFunction). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Nov 7
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/b6f57b7070e63a28ed6785798d8cbb8c634af907 commit b6f57b7070e63a28ed6785798d8cbb8c634af907 Author: Istiaque Ahmed <lazyboy@chromium.org> Date: Wed Nov 07 21:27:55 2018 Make sure RulesFunctions have Extension objects. In all the cases, we require an extension ID to be present to interact with RulesRegistry, so add checks for extension's presence in RulesRunfunction. This handles IPC Fuzzer NPE test case by killing the offending renderer. Bug: 901674 Test: See fuzzer test case. Change-Id: I8bf6e223a38be6da1666c7633d6f0b7ec45e697a Reviewed-on: https://chromium-review.googlesource.com/c/1318532 Reviewed-by: Devlin <rdevlin.cronin@chromium.org> Commit-Queue: Istiaque Ahmed <lazyboy@chromium.org> Cr-Commit-Position: refs/heads/master@{#606167} [modify] https://crrev.com/b6f57b7070e63a28ed6785798d8cbb8c634af907/extensions/browser/api/declarative/declarative_api.cc
,
Nov 7
,
Nov 8
ClusterFuzz has detected this issue as fixed in range 606163:606167. Detailed report: https://clusterfuzz.com/testcase?key=5358229468741632 Fuzzer: ipc_fuzzer_mut Job Type: linux_asan_chrome_ipc Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000198 Crash State: extensions::EventsEventRemoveRulesFunction::RunAsyncOnCorrectThread base::internal::Invoker<base::internal::BindState<std::__1::unique_ptr<Extension void base::internal::ReturnAsParamAdapter<std::__1::unique_ptr<ExtensionFunction Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_ipc&range=548504:548506 Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_ipc&range=606163:606167 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5358229468741632 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 8
ClusterFuzz testcase 5358229468741632 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by ClusterFuzz
, Nov 4Labels: Test-Predator-Auto-Components