New issue
Advanced search Search tips

Issue 910927 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Dec 9
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in net::HttpCache::Writers::DoNetworkRead

Project Member Reported by ClusterFuzz, Dec 2

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5724819393609728

Fuzzer: attekett_dom_fuzzer
Job Type: linux_asan_chrome_media
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  net::HttpCache::Writers::DoNetworkRead
  net::HttpCache::Writers::DoLoop
  net::HttpCache::Writers::Read
  
Sanitizer: address (ASAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5724819393609728

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Cc: kkaluri@chromium.org
Labels: M-72 Test-Predator-Wrong
Owner: shivanisha@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.

Using Code Search for the file, "http_cache_writers.cc" suspecting the below Cl might have caused this issue

Suspect CL: https://chromium.googlesource.com/chromium/src/+/c6582e1924c76f68e2b8873712cdf26a0b0c1edb

shivanisha@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!
Cc: morlovich@chromium.org
Looks very similar to  crbug.com/840862 
Owner: morlovich@chromium.org
Thanks, not sure of the culprit CLs, but it would be great to see it reproduced. It has also come up in the past (840862) but got fixed then.
Maks, assigning as you are looking into cache code. Please feel free to assign it to someone else on the team (if applicable).
Components: Internals>Network>Cache
This does show up occasionally in crash data, so if clusterfuzz has a way of reproducing it, it would be quite valuable
Hmm, can't reproduce it via fuzzing, but from minidumps in crash, it looks like network_transaction_ is null?
Project Member

Comment 6 by ClusterFuzz, Dec 9

ClusterFuzz has detected this issue as fixed in range 614984:614985.

Detailed report: https://clusterfuzz.com/testcase?key=5724819393609728

Fuzzer: attekett_dom_fuzzer
Job Type: linux_asan_chrome_media
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  net::HttpCache::Writers::DoNetworkRead
  net::HttpCache::Writers::DoLoop
  net::HttpCache::Writers::Read
  
Sanitizer: address (ASAN)

Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_media&range=614984:614985

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5724819393609728

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Dec 9

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5724819393609728 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment