1600130 - AddressSanitizer: heap-use-after-free [@ std::__atomic_base<unsigned long>::fetch_add] with WRITE of size 8 (HTTP channel freed by nsHttpNegotiateAuth)

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect, P2)

Description

[Christian Holler (:decoder)]

The attached testcase crashes on mozilla-central revision b5c5ba07d3db+ (build with --enable-tests --enable-address-sanitizer --disable-jemalloc --enable-optimize=-O2 --enable-fuzzing --disable-debug, include the fixes from bug 1595692).

For detailed crash information, see attachment.

I've seen several variants of this crash/use-after-free in the HttpProxyPlain fuzzing target. They all have in common that nsHttpNegotiateAuth is involved, it destroys my HTTP channel and then the fuzzing target touches it, triggering a use-after-free.

There are currently no steps to reproduce because the tests I have don't reproduce. I was assuming some kind of race would be at play here, but TSan is not reporting anything (or the report is suppressed somehow). Hence, I hope we can figure this one out just from the trace.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Release mgmt bot [:suhaib / :marco/ :calixte]]

:decoder, since this bug is a regression, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

Comment 3

[Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)]

Nhi, can you help find someone to take a closer look? Thanks!

Comment 4

[Christian Holler (:decoder)]

I have a fix for this already. I discussed this with :mayhemer and the problem is actually in the fuzzing target we believe. I will post the patch shortly. The problem seems to be that the nsHttpNegotiateAuth takes a raw pointer to the channel. I'm not sure if this could also cause problems outside of the fuzzing target (probably if other code does not anticipate this, it could, but changing this old nsHttpNegotiateAuth code is probably also not trivial).

Comment 5

[Christian Holler (:decoder)]

Attachment: Bug 1600130 - Sync HTTP fuzzing target with background thread. r?mayhemer

Comment 6

[Christian Holler (:decoder)]

Not a sec bug most likely, can be unhidden.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2907293de836
Sync HTTP fuzzing target with background thread. r=mayhemer

Comment 8

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/2907293de836