Steps to reproduce the problem

1. Download poc.html
2. Download win32-release_x64_asan-win32-release_x64-1596789.zip(https://www.googleapis.com/download/storage/v1/b/chromium-browser-asan/o/win32-release_x64%2Fasan-win32-release_x64-1596789.zip)
3. In cmd, run chrome.exe --no-sandbox poc.html

Problem Description

Overview

HarfBuzz’s Arabic shaper function apply_stch() in third_party/harfbuzz-ng/src/src/hb-ot-shaper-arabic.cc has an integer overflow that causes a heap out-of-bounds write. The function uses a 32-bit unsigned int to accumulate the number of extra glyphs needed across all “stch” (stretching) spans. By crafting a font with specific glyph advances and supplying Arabic text with enough spans, an attacker can make this counter wrap to zero at exactly 2^32, causing the buffer to not be enlarged. The subsequent copy pass then writes past the buffer boundary.

The vulnerability has existed since HarfBuzz 1.1.0 (November 2015, commit 6e6f82b6f) and affects all Chromium versions shipping HarfBuzz with the stch feature enabled.

Root Cause

apply_stch() implements a two-pass algorithm:

MEASURE pass — iterates over all stch spans and accumulates extra glyphs needed:

unsigned int extra_glyphs_needed = 0;          // line 498: 32-bit
// per span:
extra_glyphs_needed += n_copies * n_repeating; // line 587: no overflow check

Buffer allocation — uses the (now-zero) counter:

buffer->ensure(count + extra_glyphs_needed);   // line 632: ensure(count + 0)

CUT pass — copies glyphs including n_copies duplicates per span. The write index j (unsigned int) starts at count and decrements. After count decrements it reaches 0, then wraps to 0xFFFFFFFF. The write info[0xFFFFFFFF] accesses memory out of the buffer, hitting unmapped memory and causing SIGSEGV.

Crafted Font Design

The font uses upem=16384 (power of 2) to ensure exact arithmetic with Chromium’s 16.16 fixed-point scaling (SkiaScalarToHarfBuzzPosition() in skia_text_metrics.cc):

• ALEF (U+0627): advance = 16384 -> HB position = 1,048,576 (at 16px)
• REPEATING tile: advance = 1 -> HB position = 64
• GSUB stch feature: MultipleSubst substitutes BEH -> [FIXED, REPEATING]

Per span (BEH + 1024 ALEFs + TEH):

• w_total = 1024 × 1,048,576 + 64 = 1,073,741,888 (fits int32)
• n_copies = 1,073,741,888 / 64 - 1 = 16,777,216

256 spans: 256 × 16,777,216 = 4,294,967,296 = 2^32 -> wraps to 0

Attack Vector

A malicious web page can trigger this by:

1. Embedding a crafted font via @font-face (passes OTS validation)
2. Rendering Arabic text with the specific character pattern

No user interaction beyond visiting the page is required. The font passes OTS validation because the stch GSUB feature and MultipleSubst lookups are valid OpenType structures.

Summary

Integer overflow in HarfBuzz apply_stch() causes heap OOB write via crafted font + Arabic text

Custom Questions

Type of crash:

tab

Crash state:

[24344:18108:0311/102150.774:ERROR:components\device_event_log\device_event_log_impl.cc:202] [10:21:50.775] USB: usb_device_win.cc:66 Failed to open \?\usb#root_hub30#4&5375334&0&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}: Access is denied. (0x5) [24344:20808:0311/102151.566:ERROR:google_apis\gcm\engine\registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT

==25032==ERROR: AddressSanitizer: access-violation on unknown address 0x12b8fa1e17ec (pc 0x7ffc610cdc31 bp 0x00b6c8dfa660 sp 0x00b6c8dfa5d8 T0) ==25032==The signal is caused by a WRITE memory access. ==25032==*** WARNING: Failed to initialize DbgHelp! *** ==25032==*** Most likely this means that the app is already *** ==25032==*** using DbgHelp, possibly with incompatible flags. *** ==25032==*** Due to technical reasons, symbolization might crash *** ==25032==*** or produce wrong results. *** #0 0x7ffc610cdc30 (C:\WINDOWS\System32\ucrtbase.dll+0x1800edc30) #1 0x7ffbf2a0b4d2 (C:\Users\winwin\Desktop\win32-release_x64_asan-win32-release_x64-1587431\clang_rt.asan_dynamic-x86_64.dll+0x18004b4d2) #2 0x7ffb84d95e77 in apply_stch C:\b\s\w\ir\cache\builder\src\third_party\harfbuzz-ng\src\src\hb-ot-shaper-arabic.cc:616 #3 0x7ffb84d95e77 in postprocess_glyphs_arabic C:\b\s\w\ir\cache\builder\src\third_party\harfbuzz-ng\src\src\hb-ot-shaper-arabic.cc:652:3 #4 0x7ffb84de3846 in hb_ot_substitute_post C:\b\s\w\ir\cache\builder\src\third_party\harfbuzz-ng\src\src\hb-ot-shape.cc:967 #5 0x7ffb84de3846 in hb_ot_shape_internal C:\b\s\w\ir\cache\builder\src\third_party\harfbuzz-ng\src\src\hb-ot-shape.cc:1199 #6 0x7ffb84de3846 in _hb_ot_shape C:\b\s\w\ir\cache\builder\src\third_party\harfbuzz-ng\src\src\hb-ot-shape.cc:1217:3 #7 0x7ffb84ddb182 in _hb_shape_plan_execute_internal C:\b\s\w\ir\cache\builder\src\third_party\harfbuzz-ng\src\src\hb-shaper-list.hh:47 #8 0x7ffb84ddb182 in hb_shape_plan_execute C:\b\s\w\ir\cache\builder\src\third_party\harfbuzz-ng\src\src\hb-shape-plan.cc:452:14 #9 0x7ffb860c240a in hb_shape_full C:\b\s\w\ir\cache\builder\src\third_party\harfbuzz-ng\src\src\hb-shape.cc:150:19 #10 0x7ffb860c24a1 in hb_shape C:\b\s\w\ir\cache\builder\src\third_party\harfbuzz-ng\src\src\hb-shape.cc:194:3 #11 0x7ffb91e3acf4 in blink::anonymous namespace'::ShapeRange C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\fonts\shaping\harfbuzz_shaper.cc:339:3 #12 0x7ffb91e38805 in blink::HarfBuzzShaper::ShapeSegment(struct blink::RangeContext *, struct blink::RunSegmenter::RunSegmenterRange const &, class blink::ShapeResult *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\fonts\shaping\harfbuzz_shaper.cc:1024:10 #13 0x7ffb91e3cb05 in blink::HarfBuzzShaper::Shape(class blink::Font const *, enum blink::TextDirection, unsigned int, unsigned int, struct blink::RunSegmenter::RunSegmenterRange, struct blink::ShapeOptions) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\fonts\shaping\harfbuzz_shaper.cc:1148:3 #14 0x7ffb8eaa0e91 in blink::anonymous namespace’::ReusingTextShaper::Reshape C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\inline\inline_node.cc:308 #15 0x7ffb8eaa0e91 in blink::anonymous namespace'::ReusingTextShaper::ShapeWithoutCache C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\inline\inline_node.cc:186 #16 0x7ffb8eaa0e91 in blink::anonymous namespace’::ReusingTextShaper::Shape::<lambda_1>::operator() C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\inline\inline_node.cc:169:14 #17 0x7ffb8ea84d91 in blink::NGShapeCache::GetOrCreate C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\fonts\shaping\ng_shape_cache.h:112 #18 0x7ffb8ea84d91 in blink::anonymous namespace'::ReusingTextShaper::Shape C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\inline\inline_node.cc:172 #19 0x7ffb8ea84d91 in blink::InlineNode::ShapeText(struct blink::InlineItemsData *, class blink::String const *, class blink::BasicHeapVector<1, class cppgc::internal::BasicMember<class blink::InlineItem, class cppgc::internal::StrongMemberTag, struct cppgc::internal::DijkstraWriteBarrierPolicy, class cppgc::internal::DisabledCheckingPolicy, class cppgc::internal::CompressedPointer>, 0> const *, class blink::Font const *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\inline\inline_node.cc:1658:16 #20 0x7ffb8ea71512 in blink::InlineNode::ShapeTextIncludingFirstLine(struct blink::InlineNodeData *, class blink::String const *, class blink::BasicHeapVector<1, class cppgc::internal::BasicMember<class blink::InlineItem, class cppgc::internal::StrongMemberTag, struct cppgc::internal::DijkstraWriteBarrierPolicy, class cppgc::internal::DisabledCheckingPolicy, class cppgc::internal::CompressedPointer>, 0> const *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\inline\inline_node.cc:1803:3 #21 0x7ffb8ea70134 in blink::InlineNode::PrepareLayout(struct blink::InlineNodeData *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\inline\inline_node.cc:664:3 #22 0x7ffb8ea6fae5 in blink::InlineNode::PrepareLayoutIfNeeded(void) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\inline\inline_node.cc:648:3 #23 0x7ffb8ea7a476 in blink::InlineNode::EnsureData(void) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\inline\inline_node.cc:1042:3 #24 0x7ffb8ef6f0af in blink::InlineNode::IsBlockLevel C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\inline\inline_node.h:106 #25 0x7ffb8ef6f0af in blink::BlockNode::FirstChild(void) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:1156:20 #26 0x7ffb8ef70313 in blink::BlockNode::IsInlineFormattingContextRoot(class blink::InlineNode *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:1303:35 #27 0x7ffb8ef8d7e1 in blink::BlockLayoutAlgorithm::Layout(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:599:14 #28 0x7ffb8ef768ae in blink::anonymous namespace’::LayoutWithAlgorithm::<lambda_1>::operator() C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:197 #29 0x7ffb8ef768ae in blink::anonymous namespace'::CreateAlgorithmAndRun<blink::BlockLayoutAlgorithm,lambda at ....\third_party\blink\renderer\core\layout\block_node.cc:196:28’> C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:109:3 #30 0x7ffb8ef61ddc in blink::anonymous namespace'::LayoutWithAlgorithm C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:195 #31 0x7ffb8ef61ddc in blink::BlockNode::Layout(class blink::ConstraintSpace const &, class blink::BlockBreakToken const *, class blink::EarlyBreak const *, class blink::ColumnSpannerPath const *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:553:21 #32 0x7ffb8efa1448 in blink::anonymous namespace’::LayoutBlockChild C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:119 #33 0x7ffb8efa1448 in blink::BlockLayoutAlgorithm::LayoutNewFormattingContext(class blink::LayoutInputNode, class blink::BlockBreakToken const *, struct blink::InflowChildData const &, struct blink::BfcOffset, bool, struct blink::BfcOffset *, struct blink::BoxStrut *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:2166:41 #34 0x7ffb8ef9e7e4 in blink::BlockLayoutAlgorithm::HandleNewFormattingContext(class blink::LayoutInputNode, class blink::BlockBreakToken const *, struct blink::PreviousInflowPosition *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:1941:39 #35 0x7ffb8ef8ff56 in blink::BlockLayoutAlgorithm::Layout(class blink::InlineChildLayoutContext *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:1084:18 #36 0x7ffb8ef8d801 in blink::BlockLayoutAlgorithm::Layout(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:602:14 #37 0x7ffb8ef768ae in blink::anonymous namespace'::LayoutWithAlgorithm::<lambda_1>::operator() C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:197 #38 0x7ffb8ef768ae in blink::anonymous namespace’::CreateAlgorithmAndRun<blink::BlockLayoutAlgorithm,lambda at ..\..\third_party\blink\renderer\core\layout\block_node.cc:196:28'> C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:109:3 #39 0x7ffb8ef61ddc in blink::anonymous namespace’::LayoutWithAlgorithm C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:195 #40 0x7ffb8ef61ddc in blink::BlockNode::Layout(class blink::ConstraintSpace const &, class blink::BlockBreakToken const *, class blink::EarlyBreak const *, class blink::ColumnSpannerPath const *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:553:21 #41 0x7ffb8efb0aae in blink::anonymous namespace'::LayoutBlockChild C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:119 #42 0x7ffb8efb0aae in blink::anonymous namespace’::LayoutInflow C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:134:10 #43 0x7ffb8efafd47 in blink::BlockLayoutAlgorithm::HandleInflow(class blink::LayoutInputNode, class blink::BreakToken const *, struct blink::PreviousInflowPosition *, class blink::InlineChildLayoutContext *, class blink::InlineBreakToken const **) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:2350:7 #44 0x7ffb8ef8ffca in blink::BlockLayoutAlgorithm::Layout(class blink::InlineChildLayoutContext *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:1089:18 #45 0x7ffb8ef8d801 in blink::BlockLayoutAlgorithm::Layout(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:602:14 #46 0x7ffb8ef768ae in blink::anonymous namespace'::LayoutWithAlgorithm::<lambda_1>::operator() C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:197 #47 0x7ffb8ef768ae in blink::anonymous namespace’::CreateAlgorithmAndRun<blink::BlockLayoutAlgorithm,lambda at ..\..\third_party\blink\renderer\core\layout\block_node.cc:196:28'> C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:109:3 #48 0x7ffb8ef61ddc in blink::anonymous namespace’::LayoutWithAlgorithm C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:195 #49 0x7ffb8ef61ddc in blink::BlockNode::Layout(class blink::ConstraintSpace const &, class blink::BlockBreakToken const *, class blink::EarlyBreak const *, class blink::ColumnSpannerPath const *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:553:21 #50 0x7ffb8efb0aae in blink::anonymous namespace'::LayoutBlockChild C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:119 #51 0x7ffb8efb0aae in blink::anonymous namespace’::LayoutInflow C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:134:10 #52 0x7ffb8efafd47 in blink::BlockLayoutAlgorithm::HandleInflow(class blink::LayoutInputNode, class blink::BreakToken const *, struct blink::PreviousInflowPosition *, class blink::InlineChildLayoutContext *, class blink::InlineBreakToken const **) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:2350:7 #53 0x7ffb8ef8ffca in blink::BlockLayoutAlgorithm::Layout(class blink::InlineChildLayoutContext *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:1089:18 #54 0x7ffb8ef8d801 in blink::BlockLayoutAlgorithm::Layout(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:602:14 #55 0x7ffb8ef768ae in blink::anonymous namespace'::LayoutWithAlgorithm::<lambda_1>::operator() C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:197 #56 0x7ffb8ef768ae in blink::anonymous namespace’::CreateAlgorithmAndRun<blink::BlockLayoutAlgorithm,lambda at ..\..\third_party\blink\renderer\core\layout\block_node.cc:196:28'> C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:109:3 #57 0x7ffb8ef61ddc in blink::anonymous namespace’::LayoutWithAlgorithm C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:195 #58 0x7ffb8ef61ddc in blink::BlockNode::Layout(class blink::ConstraintSpace const &, class blink::BlockBreakToken const *, class blink::EarlyBreak const *, class blink::ColumnSpannerPath const *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:553:21 #59 0x7ffb8efa1448 in blink::anonymous namespace'::LayoutBlockChild C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:119 #60 0x7ffb8efa1448 in blink::BlockLayoutAlgorithm::LayoutNewFormattingContext(class blink::LayoutInputNode, class blink::BlockBreakToken const *, struct blink::InflowChildData const &, struct blink::BfcOffset, bool, struct blink::BfcOffset *, struct blink::BoxStrut *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:2166:41 #61 0x7ffb8ef9e7e4 in blink::BlockLayoutAlgorithm::HandleNewFormattingContext(class blink::LayoutInputNode, class blink::BlockBreakToken const *, struct blink::PreviousInflowPosition *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:1941:39 #62 0x7ffb8ef8ff56 in blink::BlockLayoutAlgorithm::Layout(class blink::InlineChildLayoutContext *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:1084:18 #63 0x7ffb8ef8d801 in blink::BlockLayoutAlgorithm::Layout(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_layout_algorithm.cc:602:14 #64 0x7ffb8ef768ae in blink::anonymous namespace’::LayoutWithAlgorithm::<lambda_1>::operator() C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:197 #65 0x7ffb8ef768ae in blink::anonymous namespace'::CreateAlgorithmAndRun<blink::BlockLayoutAlgorithm,lambda at ....\third_party\blink\renderer\core\layout\block_node.cc:196:28’> C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:109:3 #66 0x7ffb8ef61ddc in blink::anonymous namespace'::LayoutWithAlgorithm C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:195 #67 0x7ffb8ef61ddc in blink::BlockNode::Layout(class blink::ConstraintSpace const &, class blink::BlockBreakToken const *, class blink::EarlyBreak const *, class blink::ColumnSpannerPath const *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\block_node.cc:553:21 #68 0x7ffb8e80155b in blink::LayoutView::LayoutRoot(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\layout\layout_view.cc:908:19 #69 0x7ffb8fdc83b1 in blink::LocalFrameView::PerformLayout(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:791:24 #70 0x7ffb8fdca936 in blink::LocalFrameView::UpdateLayout(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:848:3 #71 0x7ffb8fdea028 in blink::LocalFrameView::UpdateStyleAndLayoutInternal(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:3427:7 #72 0x7ffb8fdd43ef in blink::LocalFrameView::UpdateStyleAndLayout(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:3353:18 #73 0x7ffb927f7f7d in blink::Document::UpdateStyleAndLayout(enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\document.cc:3092:17 #74 0x7ffb9043baca in blink::FrameSelection::SetSelectionFromNone(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\editing\frame_selection.cc:1291:17 #75 0x7ffb9043b572 in blink::FrameSelection::FocusedOrActiveStateChanged(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\editing\frame_selection.cc:1065:5 #76 0x7ffb7bf0c9d2 in blink::mojom::blink::FrameWidgetStubDispatch::Accept(class blink::mojom::blink::FrameWidget *, class mojo::Message *) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\blink\public\mojom\page\widget.mojom-blink.cc:2608:13 #77 0x7ffb82f170f4 in mojo::InterfaceEndpointClient::HandleValidatedMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:1085:54 #78 0x7ffb82f13e3d in mojo::MessageDispatcher::Accept(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\message_dispatcher.cc:44:19 #79 0x7ffb82f1d7de in mojo::InterfaceEndpointClient::HandleIncomingMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:747:20 #80 0x7ffb8694a5f6 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread C:\b\s\w\ir\cache\builder\src\ipc\ipc_mojo_bootstrap.cc:1199:24 #81 0x7ffb8694cb11 in base::internal::DecayedFunctorTraits<void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::anonymous namespace’::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::anonymous namespace'::ScopedUrgentMessageNotification &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:740 #82 0x7ffb8694cb11 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::anonymous namespace’::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::anonymous namespace'::ScopedUrgentMessageNotification &&>,void,0,1,2>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:932 #83 0x7ffb8694cb11 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::anonymous namespace’::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::anonymous namespace'::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::anonymous namespace’::ScopedUrgentMessageNotification),scoped_refptrIPC::ChannelAssociatedGroupController,mojo::Message,IPC::anonymous namespace'::ScopedUrgentMessageNotification>,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1069 #84 0x7ffb8694cb11 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::anonymous namespace’::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::anonymous namespace'::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::anonymous namespace’::ScopedUrgentMessageNotification),scoped_refptrIPC::ChannelAssociatedGroupController,mojo::Message,IPC::`anonymous namespace’::ScopedUrgentMessageNotification>,void ()>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:982:12 #85 0x7ffb831ef9d8 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:155 #86 0x7ffb831ef9d8 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:229:34 #87 0x7ffb831bfe21 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:112 #88 0x7ffb831bfe21 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:475:23 #89 0x7ffb831bec83 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:346:40 #90 0x7ffb83329920 in base::MessagePumpDefault::Run(class base::MessagePump::Delegate ) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:42:55 #91 0x7ffb831c1b6f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, class base::TimeDelta) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:650:12 #92 0x7ffb832675fc in base::RunLoop::Run(class base::Location const &) C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:135:14 #93 0x7ffb8d7baa93 in content::RendererMain(struct content::MainFunctionParams) C:\b\s\w\ir\cache\builder\src\content\renderer\renderer_main.cc:364:16 #94 0x7ffb7edf6a16 in content::RunOtherNamedProcessTypeMain(class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::Cr::allocator<char>> const &, struct content::MainFunctionParams, class content::ContentMainDelegate *) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:762:14 #95 0x7ffb7edf917b in content::ContentMainRunnerImpl::Run(void) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1152:10 #96 0x7ffb7edecf7f in content::RunContentProcess(struct content::ContentMainParams, class content::ContentMainRunner *) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:358:36 #97 0x7ffb7eded722 in content::ContentMain(struct content::ContentMainParams) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:371:10 #98 0x7ffb6ed42b06 in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:191:12 #99 0x7ff6fcd24807 in MainDllLoader::Launch(struct HINSTANCE, class base::TimeTicks) C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:204:12 #100 0x7ff6fcd22074 in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:351:20 #101 0x7ff6fd21ce7f in invoke_main D:\a_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78 #102 0x7ff6fd21ce7f in __scrt_common_main_seh D:\a_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288 #103 0x7ffc62f6e8d6 (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e8d6) #104 0x7ffc6478c40b (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18008c40b)

==25032==Register values: rax = 12b8fa1e17ec rbx = 12b8fa1e17ec rcx = 12b8fa1e17ec rdx = 12a4fa6e53d8 rdi = 12a4fa6e53d8 rsi = 14 rbp = b6c8dfa660 rsp = b6c8dfa5d8 r8 = 14 r9 = 2571f43c2ff r10 = 7ffc60fe0000 r11 = 0 r12 = 1000000 r13 = 12a4fad053d8 r14 = ffffffff r15 = ffffffffffffffd3 AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: access-violation (C:\WINDOWS\System32\ucrtbase.dll+0x1800edc30)

==25032==ADDITIONAL INFO

==25032==Note: Please include this section with the ASan report. Task trace: #0 0x7ffb86944419 in IPC::ChannelAssociatedGroupController::Accept(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\ipc\ipc_mojo_bootstrap.cc:1138:13

Command line: "C:\Users\winwin\Desktop\win32-release_x64_asan-win32-release_x64-1587431\chrome.exe" --type=renderer --unsafely-treat-insecure-origin-as-secure=http://172.30.1.200:8888 --no-pre-read-main-dll --no-sandbox --enable-unsafe-webgpu --file-url-path-alias="/gen=C:\Users\winwin\Desktop\win32-release_x64_asan-win32-release_x64-1587431\gen" --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1772769509573503 --launch-time-ticks=422601159186 --metrics-shmem-handle=4316,i,16590150145926551397,3420061095256368019,2097152 --field-trial-handle=1848,i,9800470822139892438,6761809189957616281,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,8348267116812909868,17333413211753954901,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4036 /prefetch:1

==25032==END OF ADDITIONAL INFO

==25032==ABORTING

Reporter credit:

pwn2addr

Additional Data

Category: Security
Chrome Channel: Not sure
Regression: N/A \