New issue
Advanced search Search tips

Issue 901674 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Nov 7
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in extensions::EventsEventRemoveRulesFunction::RunAsyncOnCorrectThread

Project Member Reported by ClusterFuzz, Nov 4

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5358229468741632

Fuzzer: ipc_fuzzer_mut
Job Type: linux_asan_chrome_ipc
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000198
Crash State:
  extensions::EventsEventRemoveRulesFunction::RunAsyncOnCorrectThread
  base::internal::Invoker<base::internal::BindState<std::__1::unique_ptr<Extension
  void base::internal::ReturnAsParamAdapter<std::__1::unique_ptr<ExtensionFunction
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_ipc&range=548504:548506

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5358229468741632

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 4

Components: Platform>Extensions
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Nov 4

Labels: Test-Predator-Auto-Owner
Owner: lazyboy@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/716e18423192709f88bce7766532ef4963c66508 ([Extensions] declarative API function -> UIThreadExtensionFunction).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Project Member

Comment 3 by bugdroid1@chromium.org, Nov 7

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b6f57b7070e63a28ed6785798d8cbb8c634af907

commit b6f57b7070e63a28ed6785798d8cbb8c634af907
Author: Istiaque Ahmed <lazyboy@chromium.org>
Date: Wed Nov 07 21:27:55 2018

Make sure RulesFunctions have Extension objects.

In all the cases, we require an extension ID to be present
to interact with RulesRegistry, so add checks for extension's
presence in RulesRunfunction.

This handles IPC Fuzzer NPE test case by killing the offending
renderer.

Bug:  901674 
Test: See fuzzer test case.
Change-Id: I8bf6e223a38be6da1666c7633d6f0b7ec45e697a
Reviewed-on: https://chromium-review.googlesource.com/c/1318532
Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
Commit-Queue: Istiaque Ahmed <lazyboy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#606167}
[modify] https://crrev.com/b6f57b7070e63a28ed6785798d8cbb8c634af907/extensions/browser/api/declarative/declarative_api.cc

Status: Fixed (was: Assigned)
Project Member

Comment 5 by ClusterFuzz, Nov 8

ClusterFuzz has detected this issue as fixed in range 606163:606167.

Detailed report: https://clusterfuzz.com/testcase?key=5358229468741632

Fuzzer: ipc_fuzzer_mut
Job Type: linux_asan_chrome_ipc
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000198
Crash State:
  extensions::EventsEventRemoveRulesFunction::RunAsyncOnCorrectThread
  base::internal::Invoker<base::internal::BindState<std::__1::unique_ptr<Extension
  void base::internal::ReturnAsParamAdapter<std::__1::unique_ptr<ExtensionFunction
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_ipc&range=548504:548506
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_ipc&range=606163:606167

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5358229468741632

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Nov 8

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 5358229468741632 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment