1806104 - Hit MOZ_CRASH(Unused) at netwerk/base/FuzzySecurityInfo.cpp:22

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect)

Description

[Christian Holler (:decoder)]

The attached testcase crashes on mozilla-central revision 20221216-ef0d179e0aeb (fuzzing build).

For detailed crash information, see attachment.

To reproduce the issue, perform the following steps:

1. Download the attached testcase, save as "test.bin".
   2a. Build with --enable-fuzzing (requires Clang and ASan, also build gtests using ./mach gtest dontruntests).
   2b. Alternatively you can download builds from TC using python -mfuzzfetch -a --fuzzing --target firefox gtest (see https://github.com/MozillaSecurity/fuzzfetch).
2. Run FUZZER=NetworkHttp2 objdir/dist/bin/firefox test.bin

I'm marking this s-s not because this is a sec bug per se but because it blocks us from resuming the HTTP2 fuzzing that was down for a month. We can unhide this once the fuzzing is back up.

I also have a simple patch for this, coming up.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Christian Holler (:decoder)]

Attachment: Bug 1806104 - Add missing security state for HTTP/2 fuzzing. r?keeler

Comment 4

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Add missing security state for HTTP/2 fuzzing. r=necko-reviewers,valentin
https://hg.mozilla.org/integration/autoland/rev/e7ef485d4085db4c8ee3ce3bed8a7ed3e873a73c
https://hg.mozilla.org/mozilla-central/rev/e7ef485d4085