1786010 - Crash [@ mozilla::net::Http2Session::ResponseHeadersComplete] with HTTP/2 Proxy

Status: RESOLVED DUPLICATE of bug 1786009

(Core :: Networking: HTTP, defect)

Description

[Christian Holler (:decoder)]

The attached testcase crashes on mozilla-central revision 20220818-6502583dede7 (build with (metadatabuildFlags not available)).

For detailed crash information, see attachment.

To reproduce the issue, perform the following steps:

1. Download the attached testcase, save as "test.bin".
   2a. Build with --enable-fuzzing (requires Clang and ASan, also build gtests using ./mach gtest dontruntests).
   2b. Alternatively you can download builds from TC using python -mfuzzfetch -a --fuzzing --target firefox gtest (see https://github.com/MozillaSecurity/fuzzfetch).
2. Run FUZZER=NetworkHttp2ProxyHttp2 objdir/dist/bin/firefox test.bin

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

:decoder, since this bug is a regression, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

Comment 4

[Kershaw Chang [:kershaw]]

This has the same root cause as bug 1786009, so I'd like to make this a dup.