862890 - WebRTC TURN use-after-free [@nr_turn_client_process_response]

Status: RESOLVED DUPLICATE of bug 946733

(Core :: WebRTC: Networking, defect, P1)

Description

[Christoph Diehl [:posidron]]

Attachment: callstack

This happened during experimental fuzzing of TURN while being a MITM.


alloc: media/mtransport/third_party/nICEr/src/stun/turn_client_ctx.c:102 

*  if (!(sctx=RCALLOC(sizeof(nr_turn_stun_ctx))))
    ABORT(R_NO_MEMORY);


free: media/mtransport/third_party/nICEr/src/stun/turn_client_ctx.c:386

  /* Destroy the STUN client ctxs */
  while (!STAILQ_EMPTY(&ctx->stun_ctxs)) {
    nr_turn_stun_ctx *stun = STAILQ_FIRST(&ctx->stun_ctxs);
    STAILQ_REMOVE_HEAD(&ctx->stun_ctxs, entry);
*   nr_turn_stun_ctx_destroy(&stun); 
  }


re-use: media/mtransport/third_party/nICEr/src/stun/turn_client_ctx.c:555

*  sc1 = STAILQ_FIRST(&ctx->stun_ctxs);



I don't have a testcase for this handy.

Tested with m-i changeset: 129073:b9f7fd0996f0

Comment 1

[Andrew McCreight [:mccr8]]

When did TURN land?  Is it disabled everywhere at the moment?  I'm going to set it affected on 23 in case it gets turned on in 23.

Comment 2

[Maire Reavy [:mreavy]]

TURN is on in 23 (Nightly) currently. It landed about a week ago.  See Bug 855769 and Bug 786235 for more details.

Comment 3

[Andrew McCreight [:mccr8]]

Thanks!

Comment 4

[Maire Reavy [:mreavy]]

Christoph - Can you get us a test case for this?

Comment 5

[Lukas Blakk [:lsblakk] use ?needinfo]

It's been a week without activity here - Christoph do you have an eta on a test case?

Comment 6

[Christoph Diehl [:posidron]]

No sorry, this crash wasn't reproducible with a single testcase.

Comment 7

[Al Billings [:abillings - ex-MoCo]]

Eric, are you going to be able to proceed without a testcase? If not, we should probably close this as incomplete until we can reproduce this issue.

Comment 8

[Maire Reavy [:mreavy]]

We should no longer be tracking this for 23.  Please see comment 7. (We would need a test case to proceed.)

Comment 9

[Byron Campen [:bwc]]

Almost positive this is a dupe of bug 946733.