New issue
Advanced search Search tips

Issue 919184 link

Starred by 1 user
Status: Assigned
Owner:
rch@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug



Sign in to add a comment

Pending stream incorrectly converted to a valid stream during QuicChromiumClientSession::SendRstStream

Project Member Reported by zhongyi@chromium.org, Jan 4 
Creating this bug to so that when the PendingStream cl relands in chromium, the underlying chromium specific bug is fixed.

We're currently getting a lot of UAF crashes per net_quic_stream_factory_fuzzer. Mostly triggered by sending rst stream for a Pending Stream. 

A pending stream may call QuicSession::SendRstStream() to send a reset stream when a reset stream frame is received or a reset needs to be sent during processing. 

In chromium, however, QuicChromiumClientSession::SendRstStream overrides the base class and calls QuicSession::GetOrCreateStream() to grab the steam upfront. However, QuicSession::GetOrCreateStream() has an assumption that it's always called on a non-pending stream, and always set |may_buffer| to false. When a stream is a pending stream, QuicSession::GetOrCreateStream will incorrectly convert a pending stream to a valid stream.
Project Member

Comment 1 by bugdroid1@chromium.org, Jan 5 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/96014258b10b68369fc49c93ce594e0ae250f50e

commit 96014258b10b68369fc49c93ce594e0ae250f50e
Author: Zhongyi Shi <zhongyi@chromium.org>
Date: Sat Jan 05 01:19:47 2019

Revert internal change: 226538637 due to UAF issues.

Original change message:
  Use PendingStreams to buffer incoming streams.
  Behavior changes protected by  QUIC version 99

  Allow QuicSession to buffer frames for incoming streams in a PendingStream
  until the first byte arrives, if ShouldBufferIncomingStream() returns true.
  Change QuicSpdySession to return true for v99 unidirectional streams.

  Merge internal change: 226538637

Bug: 919184, 919073,  919048 , 919014,  918890 ,  918834 , 918888,  918832 , 918849
Change-Id: I14be0f9d97de31bf6ea0d40afe5e457a318e8f02
Reviewed-on: https://chromium-review.googlesource.com/c/1396312
Reviewed-by: Nick Harper <nharper@chromium.org>
Commit-Queue: Zhongyi Shi <zhongyi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#620141}
[modify] https://crrev.com/96014258b10b68369fc49c93ce594e0ae250f50e/net/third_party/quic/core/http/quic_spdy_session.cc
[modify] https://crrev.com/96014258b10b68369fc49c93ce594e0ae250f50e/net/third_party/quic/core/http/quic_spdy_session.h
[modify] https://crrev.com/96014258b10b68369fc49c93ce594e0ae250f50e/net/third_party/quic/core/http/quic_spdy_session_test.cc
[modify] https://crrev.com/96014258b10b68369fc49c93ce594e0ae250f50e/net/third_party/quic/core/quic_session.cc
[modify] https://crrev.com/96014258b10b68369fc49c93ce594e0ae250f50e/net/third_party/quic/core/quic_session.h
[modify] https://crrev.com/96014258b10b68369fc49c93ce594e0ae250f50e/net/third_party/quic/core/quic_session_test.cc
Project Member

Comment 2 by bugdroid1@chromium.org, Jan 11 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7adf0a361b75d1f13859cc07ec0b22c353619cf0

commit 7adf0a361b75d1f13859cc07ec0b22c353619cf0
Author: Ryan Hamilton <rch@chromium.org>
Date: Fri Jan 11 02:19:23 2019

Re-land 96014258b10b68369fc49c93ce594e0ae250f50e which re-lands
internal change 226538637 to use PendingStreams.

Revert "Revert internal change: 226538637 due to UAF issues."

This reverts commit 96014258b10b68369fc49c93ce594e0ae250f50e.

    Revert internal change: 226538637 due to UAF issues.

    Original change message:
      Use PendingStreams to buffer incoming streams.
      Behavior changes protected by  QUIC version 99

      Allow QuicSession to buffer frames for incoming streams in a PendingStream
      until the first byte arrives, if ShouldBufferIncomingStream() returns true.
      Change QuicSpdySession to return true for v99 unidirectional streams.

      Merge internal change: 226538637

Change-Id: I936c08561ea61d6271e3f2fa4fb06f9796552329

Bug: 919184, 919073,  919048 , 919014,  918890 ,  918834 , 918888,  918832 , 918849
Change-Id: I936c08561ea61d6271e3f2fa4fb06f9796552329
Reviewed-on: https://chromium-review.googlesource.com/c/1404383
Reviewed-by: Zhongyi Shi <zhongyi@chromium.org>
Commit-Queue: Ryan Hamilton <rch@chromium.org>
Cr-Commit-Position: refs/heads/master@{#621873}
[modify] https://crrev.com/7adf0a361b75d1f13859cc07ec0b22c353619cf0/net/quic/quic_chromium_client_session.cc
[modify] https://crrev.com/7adf0a361b75d1f13859cc07ec0b22c353619cf0/net/third_party/quic/core/http/quic_spdy_session.cc
[modify] https://crrev.com/7adf0a361b75d1f13859cc07ec0b22c353619cf0/net/third_party/quic/core/http/quic_spdy_session.h
[modify] https://crrev.com/7adf0a361b75d1f13859cc07ec0b22c353619cf0/net/third_party/quic/core/http/quic_spdy_session_test.cc
[modify] https://crrev.com/7adf0a361b75d1f13859cc07ec0b22c353619cf0/net/third_party/quic/core/quic_session.cc
[modify] https://crrev.com/7adf0a361b75d1f13859cc07ec0b22c353619cf0/net/third_party/quic/core/quic_session.h
[modify] https://crrev.com/7adf0a361b75d1f13859cc07ec0b22c353619cf0/net/third_party/quic/core/quic_session_test.cc
[modify] https://crrev.com/7adf0a361b75d1f13859cc07ec0b22c353619cf0/net/third_party/quic/core/quic_stream.h
►

Sign in to add a comment