==1795377==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c827e119d14 at pc 0x7f12fcc0c1e9 bp 0x7b1271590750 sp 0x7b1271590748 WRITE of size 4 at 0x7c827e119d14 thread T7 (Chrome_ChildIOT) #0 0x7f12fcc0c1e8 in net::SpdyStream::IncreaseRecvWindowSize(int) net/spdy/spdy_stream.cc:289:32 #1 0x7f12fcc10913 in net::SpdyStream::OnPaddingConsumed(unsigned long) net/spdy/spdy_stream.cc:497:3 #2 0x7f12fcbd6cd4 in net::SpdySession::OnStreamPadding(unsigned int, unsigned long) net/spdy/spdy_session.cc:3032:15 #3 0x7f12fb3c9537 in http2::FrameDecoderState::ReadPadLength(http2::DecodeBuffer*, bool) net/third_party/quiche/src/quiche/http2/decoder/frame_decoder_state.cc:29:21 #4 0x7f12fb3ce259 in http2::DataPayloadDecoder::ResumeDecodingPayload(http2::FrameDecoderState*, http2::DecodeBuffer*) net/third_party/quiche/src/quiche/http2/decoder/payload_decoders/data_payload_decoder.cc:98:23 #5 0x7f12fb3ca47f in http2::Http2FrameDecoder::StartDecodingPayload(http2::DecodeBuffer*) net/third_party/quiche/src/quiche/http2/decoder/http2_frame_decoder.cc:293:32 #6 0x7f12fb3c9e29 in http2::Http2FrameDecoder::DecodeFrame(http2::DecodeBuffer*) net/third_party/quiche/src/quiche/http2/decoder/http2_frame_decoder.cc:57:16 #7 0x7f12fb3993d5 in http2::Http2DecoderAdapter::ProcessInputFrame(char const*, unsigned long) net/third_party/quiche/src/quiche/http2/core/http2_frame_decoder_adapter.cc:800:40 #8 0x7f12fb399206 in http2::Http2DecoderAdapter::ProcessInput(char const*, unsigned long) net/third_party/quiche/src/quiche/http2/core/http2_frame_decoder_adapter.cc:272:30 #9 0x7f12fcbcd528 in net::SpdySession::DoReadComplete(int) net/spdy/spdy_session.cc:2063:53 #10 0x7f12fcbcbed6 in net::SpdySession::DoReadLoop(net::SpdySession::ReadState, int) net/spdy/spdy_session.cc:1981:18 #11 0x7f12fcbc87b0 in net::SpdySession::PumpReadLoop(net::SpdySession::ReadState, int) net/spdy/spdy_session.cc:1957:17 #12 0x7f12fcbe0ef7 in base::internal::Invoker&&, net::SpdySession::ReadState&&>, base::internal::BindState, net::SpdySession::ReadState>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12 #13 0x7f12fcaff8a4 in net::SSLClientSocketImpl::DoReadCallback(int) base/functional/callback.h:155:12 #14 0x7f12fcafecee in net::SSLClientSocketImpl::RetryAllOperations() net/socket/ssl_client_socket_impl.cc:1510:5 #15 0x7f12fcad0f4e in net::SocketBIOAdapter::OnSocketReadIfReadyComplete(int) net/socket/socket_bio_adapter.cc:212:14 #16 0x7f12fcad40ee in base::internal::Invoker&&>, base::internal::BindState>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12 #17 0x7f12fcb20f40 in net::TCPClientSocket::DidCompleteRead(int) base/functional/callback.h:155:12 #18 0x7f12fcb245c5 in base::internal::Invoker, base::internal::BindState>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12 #19 0x7f12fcdac912 in net::TCPSocketPosix::ReadIfReadyCompleted(base::OnceCallback, int) base/functional/callback.h:155:12 #20 0x7f12fcdaff40 in base::internal::Invoker, int), net::TCPSocketPosix*, base::OnceCallback&&>, base::internal::BindState, int), base::internal::UnretainedWrapper, base::OnceCallback>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12 #21 0x7f12fcda6ed5 in net::SocketPosix::OnFileCanReadWithoutBlocking(int) base/functional/callback.h:155:12 #22 0x7f1302d90971 in base::MessagePumpEpoll::HandleEvent(int, bool, bool, base::MessagePumpEpoll::FdWatchController*) base/message_loop/message_pump_epoll.cc #23 0x7f1302d8fa00 in base::MessagePumpEpoll::OnEpollEvent(base::MessagePumpEpoll::EpollEventEntry&, unsigned int) base/message_loop/message_pump_epoll.cc:614:7 #24 0x7f1302d8d64f in base::MessagePumpEpoll::WaitForEpollEvents(base::TimeDelta) base/message_loop/message_pump_epoll.cc:506:7 #25 0x7f1302d8c23e in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_epoll.cc:285:5 #26 0x7f1302bdd823 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #27 0x7f1302accc72 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #28 0x7f1302c75892 in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:356:13 #29 0x7f12e2507221 in content::(anonymous namespace)::ChildIOThread::Run(base::RunLoop*) content/child/child_process.cc:69:19 #30 0x7f1302c75df5 in base::Thread::ThreadMain() base/threading/thread.cc:426:3 #31 0x7f1302cdaa4c in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #32 0x560911ee7c36 in asan_thread_start(void*) asan_interceptors.cpp 0x7c827e119d14 is located 148 bytes inside of 648-byte region [0x7c827e119c80,0x7c827e119f08) freed by thread T7 (Chrome_ChildIOT) here: #0 0x560911f23ec2 in operator delete(void*, unsigned long) (/home/sakura/chromium/src/out/asan-release/chrome+0x681cec2) (BuildId: d095d037e9fb3bcc) #1 0x7f12fcbc19a5 in net::SpdySession::CloseActiveStreamIterator(std::__Cr::__map_iterator, std::__Cr::__tree_node, void*>*, long>>, int) net/spdy/spdy_session.cc:1855:3 #2 0x7f12fcbc3e7b in net::SpdySession::StartGoingAway(unsigned int, net::Error) net/spdy/spdy_session.cc:1396:5 #3 0x7f12fcbbd03f in net::SpdySession::DoDrainSession(net::Error, std::__Cr::basic_string, std::__Cr::allocator> const&, bool) net/spdy/spdy_session.cc:2744:5 #4 0x7f12fcbcafa6 in net::SpdySession::EnqueueSessionWrite(net::RequestPriority, spdy::SpdyFrameType, std::__Cr::unique_ptr>) net/spdy/spdy_session.cc:2562:5 #5 0x7f12fcbc354a in net::SpdySession::SendWindowUpdateFrame(unsigned int, unsigned int, net::RequestPriority) net/spdy/spdy_session.cc:2473:3 #6 0x7f12fcbc2f8c in net::SpdySession::SendStreamWindowUpdate(unsigned int, unsigned int) net/spdy/spdy_session.cc:1349:3 #7 0x7f12fcc0bf49 in net::SpdyStream::IncreaseRecvWindowSize(int) net/spdy/spdy_stream.cc:284:15 #8 0x7f12fcc10913 in net::SpdyStream::OnPaddingConsumed(unsigned long) net/spdy/spdy_stream.cc:497:3 #9 0x7f12fcbd6cd4 in net::SpdySession::OnStreamPadding(unsigned int, unsigned long) net/spdy/spdy_session.cc:3032:15 #10 0x7f12fb3c9537 in http2::FrameDecoderState::ReadPadLength(http2::DecodeBuffer*, bool) net/third_party/quiche/src/quiche/http2/decoder/frame_decoder_state.cc:29:21 #11 0x7f12fb3ce259 in http2::DataPayloadDecoder::ResumeDecodingPayload(http2::FrameDecoderState*, http2::DecodeBuffer*) net/third_party/quiche/src/quiche/http2/decoder/payload_decoders/data_payload_decoder.cc:98:23 #12 0x7f12fb3ca47f in http2::Http2FrameDecoder::StartDecodingPayload(http2::DecodeBuffer*) net/third_party/quiche/src/quiche/http2/decoder/http2_frame_decoder.cc:293:32 #13 0x7f12fb3c9e29 in http2::Http2FrameDecoder::DecodeFrame(http2::DecodeBuffer*) net/third_party/quiche/src/quiche/http2/decoder/http2_frame_decoder.cc:57:16 #14 0x7f12fb3993d5 in http2::Http2DecoderAdapter::ProcessInputFrame(char const*, unsigned long) net/third_party/quiche/src/quiche/http2/core/http2_frame_decoder_adapter.cc:800:40 #15 0x7f12fb399206 in http2::Http2DecoderAdapter::ProcessInput(char const*, unsigned long) net/third_party/quiche/src/quiche/http2/core/http2_frame_decoder_adapter.cc:272:30 #16 0x7f12fcbcd528 in net::SpdySession::DoReadComplete(int) net/spdy/spdy_session.cc:2063:53 #17 0x7f12fcbcbed6 in net::SpdySession::DoReadLoop(net::SpdySession::ReadState, int) net/spdy/spdy_session.cc:1981:18 #18 0x7f12fcbc87b0 in net::SpdySession::PumpReadLoop(net::SpdySession::ReadState, int) net/spdy/spdy_session.cc:1957:17 #19 0x7f12fcbe0ef7 in base::internal::Invoker&&, net::SpdySession::ReadState&&>, base::internal::BindState, net::SpdySession::ReadState>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12 #20 0x7f12fcaff8a4 in net::SSLClientSocketImpl::DoReadCallback(int) base/functional/callback.h:155:12 #21 0x7f12fcafecee in net::SSLClientSocketImpl::RetryAllOperations() net/socket/ssl_client_socket_impl.cc:1510:5 #22 0x7f12fcad0f4e in net::SocketBIOAdapter::OnSocketReadIfReadyComplete(int) net/socket/socket_bio_adapter.cc:212:14 #23 0x7f12fcad40ee in base::internal::Invoker&&>, base::internal::BindState>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12 #24 0x7f12fcb20f40 in net::TCPClientSocket::DidCompleteRead(int) base/functional/callback.h:155:12 #25 0x7f12fcb245c5 in base::internal::Invoker, base::internal::BindState>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12 #26 0x7f12fcdac912 in net::TCPSocketPosix::ReadIfReadyCompleted(base::OnceCallback, int) base/functional/callback.h:155:12 #27 0x7f12fcdaff40 in base::internal::Invoker, int), net::TCPSocketPosix*, base::OnceCallback&&>, base::internal::BindState, int), base::internal::UnretainedWrapper, base::OnceCallback>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12 #28 0x7f12fcda6ed5 in net::SocketPosix::OnFileCanReadWithoutBlocking(int) base/functional/callback.h:155:12 #29 0x7f1302d90971 in base::MessagePumpEpoll::HandleEvent(int, bool, bool, base::MessagePumpEpoll::FdWatchController*) base/message_loop/message_pump_epoll.cc previously allocated by thread T7 (Chrome_ChildIOT) here: #0 0x560911f232bd in operator new(unsigned long) (/home/sakura/chromium/src/out/asan-release/chrome+0x681c2bd) (BuildId: d095d037e9fb3bcc) #1 0x7f12fcbc8c3e in net::SpdySession::CreateStream(net::SpdyStreamRequest const&, base::WeakPtr*) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26 #2 0x7f12fcbb6310 in net::SpdySession::TryCreateStream(base::WeakPtr const&, base::WeakPtr*) net/spdy/spdy_session.cc:1697:12 #3 0x7f12fcbb548c in net::SpdyStreamRequest::StartRequest(net::SpdyStreamType, base::WeakPtr const&, GURL const&, bool, net::RequestPriority, net::SocketTag const&, net::NetLogWithSource const&, base::OnceCallback, net::NetworkTrafficAnnotationTag const&, bool, base::TimeDelta) net/spdy/spdy_session.cc:617:17 #4 0x7f12fcb955db in net::SpdyHttpStream::InitializeStream(bool, net::RequestPriority, net::NetLogWithSource const&, base::OnceCallback) net/spdy/spdy_http_stream.cc:74:28 #5 0x7f12fc72d269 in net::HttpNetworkTransaction::DoInitStream() net/http/http_network_transaction.cc:1262:21 #6 0x7f12fc722f66 in net::HttpNetworkTransaction::DoLoop(int) net/http/http_network_transaction.cc:1031:14 #7 0x7f12fc71f7ae in net::HttpNetworkTransaction::OnIOComplete(int) net/http/http_network_transaction.cc:1003:12 #8 0x7f12fc72881a in net::HttpNetworkTransaction::OnStreamReady(net::ProxyInfo const&, std::__Cr::unique_ptr>) net/http/http_network_transaction.cc:885:3 #9 0x7f12fc7d054c in net::HttpStreamFactory::JobController::OnStreamReady(net::HttpStreamFactory::Job*) net/http/http_stream_factory_job_controller.cc:360:14 #10 0x7f12fc7cb70b in base::internal::Invoker&&, base::TimeTicks&&>, base::internal::BindState, base::TimeTicks>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #11 0x7f1302b61b59 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #12 0x7f1302bdc1d0 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #13 0x7f1302bdb1a6 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #14 0x7f1302d8c2a9 in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_epoll.cc:224:55 #15 0x7f1302bdd823 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #16 0x7f1302accc72 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #17 0x7f1302c75892 in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:356:13 #18 0x7f12e2507221 in content::(anonymous namespace)::ChildIOThread::Run(base::RunLoop*) content/child/child_process.cc:69:19 #19 0x7f1302c75df5 in base::Thread::ThreadMain() base/threading/thread.cc:426:3 #20 0x7f1302cdaa4c in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #21 0x560911ee7c36 in asan_thread_start(void*) asan_interceptors.cpp Thread T7 (Chrome_ChildIOT) created by T0 (chrome) here: #0 0x560911ecdab1 in pthread_create (/home/sakura/chromium/src/out/asan-release/chrome+0x67c6ab1) (BuildId: d095d037e9fb3bcc) #1 0x7f1302cda10c in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13 #2 0x7f1302c7411b in base::Thread::StartWithOptions(base::Thread::Options) base/threading/thread.cc:232:26 #3 0x7f12e250604c in content::ChildProcess::ChildProcess(base::ThreadType, std::__Cr::unique_ptr>, bool) content/child/child_process.cc:152:21 #4 0x7f12e725c0a7 in content::UtilityMain(content::MainFunctionParams) content/utility/utility_main.cc:459:16 #5 0x7f12e73bfc86 in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:762:14 #6 0x7f12e73c239a in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10 #7 0x7f12e73bcae3 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #8 0x7f12e73bce6a in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #9 0x560911f25215 in ChromeMain chrome/app/chrome_main.cc:194:12 #10 0x7f128ce29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 SUMMARY: AddressSanitizer: heap-use-after-free net/spdy/spdy_stream.cc:289:32 in net::SpdyStream::IncreaseRecvWindowSize(int) Shadow bytes around the buggy address: 0x7c827e119a80: 00 00 00 00 00 00 00 00 00 00 05 fc 00 00 00 00 0x7c827e119b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7c827e119b80: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa 0x7c827e119c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa 0x7c827e119c80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x7c827e119d00: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c827e119d80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c827e119e00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c827e119e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c827e119f00: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c827e119f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1795377==ADDITIONAL INFO ==1795377==Note: Please include this section with the ASan report. Task trace: Command line: `/proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --ignore-certificate-errors --crashpad-handler-pid=1795289 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/poc-net005-1776398747 --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,1615108410603134257,10010476584855033925,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,6026659812855540906,5843298622315613174,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=stderr` MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. ==1795377==END OF ADDITIONAL INFO ==1795377==ABORTING [1795276:1795276:0417/120601.505735:ERROR:content/browser/network_service_instance_impl.cc:703] Network service crashed or was terminated, restarting service. [1795276:1795276:0417/120633.058008:WARNING:content/common/zygote/zygote_communication_linux.cc:301] Error reading message from zygote: Connection reset by peer (104) [1795276:1795276:0417/120633.070252:ERROR:content/common/zygote/zygote_communication_linux.cc:291] Failed to send GetTerminationStatus message to zygote [1795276:1795276:0417/120633.070322:WARNING:content/common/zygote/zygote_communication_linux.cc:303] Socket closed prematurely. [1795276:1795276:0417/120633.071884:ERROR:content/common/zygote/zygote_communication_linux.cc:291] Failed to send GetTerminationStatus message to zygote [1795276:1795276:0417/120633.071933:WARNING:content/common/zygote/zygote_communication_linux.cc:303] Socket closed prematurely.