CVE-2024-12694
Overview
Background
- `GpuImageDecodeCache`
- The compositor-side cache in
cc/tiles/gpu_image_decode_cache.ccthat decodes and uploads images to the GPU for rasterization. - `ImageData`
- A refcounted (
scoped_refptr) cache entry holding an image’s decoded pixels and upload state, whose lifetime is normally governed by the cache’s internal lock. - `scoped_refptr`
- A smart pointer that increments an object’s reference count for as long as it is held, keeping the pointee alive.
- Lock-drop window
- The interval during
DecodeImageIfNecessaryandUploadImageIfNecessarywhere the cachelock_is released so the expensive decode/upload work can run without blocking other threads.
Root Cause Analysis
During DecodeImageIfNecessary and the GPU upload helpers, the cache releases its internal lock_ to perform the CPU-expensive decode and upload work on a raw ImageData* pointer. While the lock is not held, another thread executing the cache’s reduction/eviction logic can drop the last scoped_refptr to that same ImageData, deleting it. The vulnerable code then continues to dereference image_data, its decode member, and image_data->mode after the object has been freed, producing a use-after-free.
The invariant that was violated is that a raw ImageData* handed across a lock-drop window must be kept alive independently, because the lock that guards its refcount is no longer held.
The fix creates a local scoped_refptr<ImageData> image_data_holder(image_data) immediately before each lock-drop, taking an owning reference that guarantees the object survives until the function returns and the local goes out of scope.
lock_ to keep an ImageData alive while that very lock is intentionally dropped for decode/upload work, so a concurrent eviction can free it out from under a raw pointer. The fix pins the object with a stack-local scoped_refptr (image_data_holder) spanning the entire lock-free region, decoupling the object’s lifetime from the lock.Attack Path
- Populate the cache
The renderer rasterizes a page containing an image, causing
GpuImageDecodeCacheto create anImageDataentry and beginDecodeImageIfNecessaryorUploadImageIfNecessary. - Enter the lock-drop window
The cache releases
lock_to run the decode/upload on the rawimage_datapointer, leaving the entry’s lifetime unprotected. - Trigger concurrent eviction
Memory pressure or additional image work drives the cache’s reduction path on another thread to drop the last reference to that same
ImageData, freeing it during the window. - Use after free
The original code path resumes and dereferences the now-freed
image_data(e.g.image_data->decode,image_data->mode), reading or writing reclaimed heap memory. - Exploit the freed slot
By grooming the heap so attacker-controlled data reoccupies the freed
ImageData, the resulting corruption is steered toward controlled reads/writes and potential code execution.
Impact Assessment
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifcc/tiles/gpu_image_decode_cache.cc |
modified |
Files Changed
cc/tiles/gpu_image_decode_cache.cc
Audit Directions
- Raw pointer across a lock dropSearch every place a
lock_-guarded rawImageData*(or similar refcounted cache entry) is used after the guarding lock is released, and confirm ascoped_refptrholds it for the whole window. - Eviction vs. in-use racesReview cache reduction/eviction paths (
EnsureCapacity, ref/unref,DeletePendingImages) for entries that can be dropped while another thread is mid-decode or mid-upload without an owning reference. - Comment-marked lock releasesGrep for annotations like “while the lock is not held” and audit each such region to ensure any object touched inside it is lifetime-pinned rather than lock-pinned.
Patch
From e65f06b6dc4792fe27c6872dbc7a1d185912cc48 Mon Sep 17 00:00:00 2001 From: Stefan Zager <[email protected]> Date: Wed, 06 Nov 2024 22:26:50 +0000 Subject: [PATCH] Prevent ImageData from being reclaimed while in use Bug: chromium:368222741 Change-Id: If6b11492b01920306af042e001a65eb0d4b07f50 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5990752 Reviewed-by: Vladimir Levin <[email protected]> Commit-Queue: Stefan Zager <[email protected]> Cr-Commit-Position: refs/heads/main@{#1379290} --- diff --git a/cc/tiles/gpu_image_decode_cache.cc b/cc/tiles/gpu_image_decode_cache.cc index e39e0888..31e7d9e 100644 --- a/cc/tiles/gpu_image_decode_cache.cc +++ b/cc/tiles/gpu_image_decode_cache.cc @@ -2434,6 +2434,9 @@ image_data->decode.ResetData(); + // Prevent image_data from being deleted while lock is not held. + scoped_refptr<ImageData> image_data_holder(image_data); + // Decode the image into `aux_image_data` while the lock is not held. DecodedAuxImageData aux_image_data[kAuxImageCount]; { @@ -2761,6 +2764,9 @@ sk_sp<SkImage> uploaded_v_image = image_data->decode.image(2, AuxImage::kDefault); + // Prevent image_data from being deleted while lock is not held. + scoped_refptr<ImageData> image_data_holder(image_data); + // For kGpu, we upload and color convert (if necessary). if (image_data->mode == DecodedDataMode::kGpu) { DCHECK(!use_transfer_cache_); @@ -2848,6 +2854,9 @@ DCHECK(!use_transfer_cache_); DCHECK(!image_data->info.yuva.has_value()); + // Prevent image_data from being deleted while lock is not held. + scoped_refptr<ImageData> image_data_holder(image_data); + // RGBX decoding is below. // For kGpu, we upload and color convert (if necessary). if (image_data->mode == DecodedDataMode::kGpu) {
Original Bug Report
heap-use-after-free cc\tiles\gpu_image_decode_cache.cc:2469 in cc::GpuImageDecodeCache::DecodeImageIfNecessary
#Summary heap-use-after-free cc\tiles\gpu_image_decode_cache.cc:2469 in cc::GpuImageDecodeCache::DecodeImageIfNecessary
#Reproduce asan-win32-release_x64-1353186 This issue occurred unintentionally while I was browsing a normal page. I attempted some analysis to identify the root cause of the vulnerability, but ultimately, I was unable to reproduce it. I will share some of the work I did during this process.
#Analysis ImageData is a RefCountedThreadSafe object. The GetTaskForImageAndRefInternal function calls CreateImageData to create a new ImageData object, which is then stored in both the PersistentCache[2] and InUseCacheKey[3].
The InUseCacheKey reference count is decreased by the UnrefImage call from the Compositor thread. Meanwhile, the PersistentCache reference count is decreased during memory pressure in the ThreadPoolForegroundWorker thread when DecodeImageIfNecessary calls GpuImageDecodeCache::ClearCache.
Both UnrefImage in the Compositor thread and DecodeImageIfNecessary in the ThreadPoolForegroundWorker thread acquire base::AutoLock lock(lock_);. The DecodeImageIfNecessary function receives ImageData* image_data[6] as a raw pointer without increasing the reference count. Within this function, base::AutoUnlock unlock(lock_)[7] is used to temporarily release the lock.
Thus, there’s a potential timing issue where the ThreadPoolForegroundWorker thread releases the lock in DecodeImageIfNecessary and calls ClearCache, reducing the reference count in PersistentCache. At this point, the Compositor thread might execute UnrefImage, which further reduces the reference count through UnrefImageInternal, potentially freeing the image_data memory.
Subsequently, when the ThreadPoolForegroundWorker thread resumes execution of the remaining code in DecodeImageIfNecessary, it can lead to a use-after-free (UAF). This was identified as a possible root cause based on crash ASAN logs and my debugging analysis.
During my analysis, I confirmed that UnrefImage and ClearCache can indeed decrease the image_data reference count from different threads. However, I was unable to reproduce the issue by getting UnrefImage to execute immediately after ClearCache in DecodeImageIfNecessary.
[1] https://source.chromium.org/chromium/chromium/src/+/main:cc/tiles/gpu_image_decode_cache.cc;drc=a150b50c0ff706af12c449c7fccd3cf2745e2061;l=1310 [2] https://source.chromium.org/chromium/chromium/src/+/main:cc/tiles/gpu_image_decode_cache.cc;drc=a150b50c0ff706af12c449c7fccd3cf2745e2061;l=1397 [3] https://source.chromium.org/chromium/chromium/src/+/main:cc/tiles/gpu_image_decode_cache.cc;drc=a150b50c0ff706af12c449c7fccd3cf2745e2061;l=1401 [4] https://source.chromium.org/chromium/chromium/src/+/main:cc/tiles/gpu_image_decode_cache.cc;drc=a150b50c0ff706af12c449c7fccd3cf2745e2061;l=2151 [5] https://source.chromium.org/chromium/chromium/src/+/main:cc/tiles/gpu_image_decode_cache.cc;drc=a150b50c0ff706af12c449c7fccd3cf2745e2061;l=2425 [6] https://source.chromium.org/chromium/chromium/src/+/main:cc/tiles/gpu_image_decode_cache.cc;drc=a150b50c0ff706af12c449c7fccd3cf2745e2061;l=2359 [7] https://source.chromium.org/chromium/chromium/src/+/main:cc/tiles/gpu_image_decode_cache.cc;drc=a150b50c0ff706af12c449c7fccd3cf2745e2061;l=2407
#Asan
==1472==ERROR: AddressSanitizer: heap-use-after-free on address 0x11fe92769910 at pc 0x7ffd6dc08248 bp 0x003a3b5fe960 sp 0x003a3b5fe9a8 READ of size 8 at 0x11fe92769910 thread T4 #0 0x7ffd6dc08247 in cc::GpuImageDecodeCache::DecodeImageIfNecessary C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:2469 #1 0x7ffd6dbf699b in cc::GpuImageDecodeCache::DecodeImageAndGenerateDarkModeFilterIfNecessary C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:2351 #2 0x7ffd6dc000e9 in cc::GpuImageDecodeCache::DecodeImageInTask C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:1939 #3 0x7ffd6dc17e1c in cc::GpuImageDecodeTaskImpl::RunOnWorkerThread C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:616 #4 0x7ffd76f7bc26 in cc::ImageController::ProcessNextImageDecodeOnWorkerThread C:\b\s\w\ir\cache\builder\src\cc\tiles\image_controller.cc:309 #5 0x7ffd76f7d517 in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(cc::ImageController::WorkerState *),cc::ImageController::WorkerState >,base::internal::BindState<0,1,0,void ()(cc::ImageController::WorkerState *),base::internal::UnretainedWrappercc::ImageController::WorkerState,base::unretained_traits::MayNotDangle,0 >,void ()>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:980 #6 0x7ffd682757a0 in base::TaskAnnotator::RunTaskImpl C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:203 #7 0x7ffd713ecb2a in base::internal::TaskTracker::RunContinueOnShutdown C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:655 #8 0x7ffd713ec169 in base::internal::TaskTracker::RunTask C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:521 #9 0x7ffd713eb23e in base::internal::TaskTracker::RunAndPopNextTask C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:416 #10 0x7ffd76730c24 in base::internal::WorkerThread::RunWorker C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:493 #11 0x7ffd7672fa2f in base::internal::WorkerThread::RunPooledWorker C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:379 #12 0x7ffd6819ce45 in base::`anonymous namespace’::ThreadFunc C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:131 #13 0x7ff73039533d in asan_thread_start C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_win.cpp:147 #14 0x7ffdcc44257c in BaseThreadInitThunk+0x1c (C:\Windows\System32\KERNEL32.DLL+0x18001257c) #15 0x7ffdcd62af27 in RtlUserThreadStart+0x27 (C:\Windows\SYSTEM32\ntdll.dll+0x18005af27)
0x11fe92769910 is located 656 bytes inside of 1232-byte region [0x11fe92769680,0x11fe92769b50) freed by thread T9 here: #0 0x7ff7303a181d in free C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_malloc_win.cpp:82 #1 0x7ffd6dbf4d93 in cc::GpuImageDecodeCache::UnrefImageInternal C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:2151 #2 0x7ffd6dbf4911 in cc::GpuImageDecodeCache::UnrefImage C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:1441 #3 0x7ffd76f7ae15 in cc::ImageController::UnlockImageDecode C:\b\s\w\ir\cache\builder\src\cc\tiles\image_controller.cc:261 #4 0x7ffd723cb24d in std::__Cr::__destroy_at<std::__Cr::pair<int,std::__Cr::unique_ptr<cc::DecodedImageTracker::ImageLock,std::__Cr::default_deletecc::DecodedImageTracker::ImageLock > >,0> C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include__memory\construct_at.h:67 #5 0x7ffd723c8d5b in cc::DecodedImageTracker::UnlockAllImages C:\b\s\w\ir\cache\builder\src\cc\tiles\decoded_image_tracker.cc:62 #6 0x7ffd6dc8362c in cc::LayerTreeHostImpl::SetVisible C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host_impl.cc:3822 #7 0x7ffd72306d4b in cc::ProxyImpl::SetVisibleOnImpl C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_impl.cc:274 #8 0x7ffd6dc3ea88 in base::internal::Invoker<base::internal::FunctorTraits<void (cc::ProxyImpl::*&&)(bool),cc::ProxyImpl ,bool &&>,base::internal::BindState<1,1,0,void (cc::ProxyImpl::)(bool),base::internal::UnretainedWrappercc::ProxyImpl,base::unretained_traits::MayNotDangle,0,bool>,void ()>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:980 #9 0x7ffd682757a0 in base::TaskAnnotator::RunTaskImpl C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:203 #10 0x7ffd6c9bedcd in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:470 #11 0x7ffd6c9bdb79 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:332 #12 0x7ffd6ca025ce in base::MessagePumpDefault::Run C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:40 #13 0x7ffd6c9c0a9f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:640 #14 0x7ffd682cf96e in base::RunLoop::Run C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134 #15 0x7ffd65bc4ef9 in blink::scheduler::NonMainThreadImpl::SimpleThreadImpl::Run C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\scheduler\worker\non_main_thread_impl.cc:188 #16 0x7ffd6819ce45 in base::`anonymous namespace’::ThreadFunc C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:131 #17 0x7ff73039533d in asan_thread_start C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_win.cpp:147 #18 0x7ffdcc44257c in BaseThreadInitThunk+0x1c (C:\Windows\System32\KERNEL32.DLL+0x18001257c) #19 0x7ffdcd62af27 in RtlUserThreadStart+0x27 (C:\Windows\SYSTEM32\ntdll.dll+0x18005af27)
previously allocated by thread T9 here: #0 0x7ff7303a191d in malloc C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_malloc_win.cpp:98 #1 0x7ffd7f22286e in operator new D:\a_work\1\s\src\vctools\crt\vcstartup\src\heap\new_scalar.cpp:36 #2 0x7ffd6dbef4dd in cc::GpuImageDecodeCache::CreateImageData C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:2986 #3 0x7ffd6dbebef9 in cc::GpuImageDecodeCache::GetTaskForImageAndRefInternal C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:1310 #4 0x7ffd6dbedb0e in cc::GpuImageDecodeCache::GetOutOfRasterDecodeTaskForImageAndRef C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:1280 #5 0x7ffd76f78332 in cc::ImageController::GenerateTasksForOrphanedRequests C:\b\s\w\ir\cache\builder\src\cc\tiles\image_controller.cc:382 #6 0x7ffd76f77c7b in cc::ImageController::SetImageDecodeCache C:\b\s\w\ir\cache\builder\src\cc\tiles\image_controller.cc:148 #7 0x7ffd72353ba4 in cc::TileManager::SetResources C:\b\s\w\ir\cache\builder\src\cc\tiles\tile_manager.cc:628 #8 0x7ffd6dc70151 in cc::LayerTreeHostImpl::CreateTileManagerResources C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host_impl.cc:3926 #9 0x7ffd6dc86ee9 in cc::LayerTreeHostImpl::InitializeFrameSink C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host_impl.cc:4217 #10 0x7ffd72305dbc in cc::ProxyImpl::InitializeLayerTreeFrameSinkOnImpl C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_impl.cc:193 #11 0x7ffd6dc3e4d1 in base::internal::Invoker<base::internal::FunctorTraits<void (cc::ProxyImpl::*&&)(cc::LayerTreeFrameSink *, base::WeakPtrcc::ProxyMain),cc::ProxyImpl *,cc::LayerTreeFrameSink &&,base::WeakPtrcc::ProxyMain &&>,base::internal::BindState<1,1,0,void (cc::ProxyImpl::)(cc::LayerTreeFrameSink , base::WeakPtrcc::ProxyMain),base::internal::UnretainedWrappercc::ProxyImpl,base::unretained_traits::MayNotDangle,0,base::internal::UnretainedWrappercc::LayerTreeFrameSink,base::unretained_traits::MayNotDangle,0,base::WeakPtrcc::ProxyMain >,void ()>::RunImpl<void (cc::ProxyImpl::)(cc::LayerTreeFrameSink *, base::WeakPtrcc::ProxyMain),std::__Cr::tuple<base::internal::UnretainedWrappercc::ProxyImpl,base::unretained_traits::MayNotDangle,0,base::internal::UnretainedWrappercc::LayerTreeFrameSink,base::unretained_traits::MayNotDangle,0,base::WeakPtrcc::ProxyMain >,0,1,2> C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1067 #12 0x7ffd682757a0 in base::TaskAnnotator::RunTaskImpl C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:203 #13 0x7ffd6c9bedcd in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:470 #14 0x7ffd6c9bdb79 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:332 #15 0x7ffd6ca025ce in base::MessagePumpDefault::Run C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:40 #16 0x7ffd6c9c0a9f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:640 #17 0x7ffd682cf96e in base::RunLoop::Run C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134 #18 0x7ffd65bc4ef9 in blink::scheduler::NonMainThreadImpl::SimpleThreadImpl::Run C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\scheduler\worker\non_main_thread_impl.cc:188 #19 0x7ffd6819ce45 in base::`anonymous namespace’::ThreadFunc C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:131 #20 0x7ff73039533d in asan_thread_start C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_win.cpp:147 #21 0x7ffdcc44257c in BaseThreadInitThunk+0x1c (C:\Windows\System32\KERNEL32.DLL+0x18001257c) #22 0x7ffdcd62af27 in RtlUserThreadStart+0x27 (C:\Windows\SYSTEM32\ntdll.dll+0x18005af27)
Thread T4 created by T0 here: #0 0x7ff730395252 in CreateThread C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_win.cpp:158 #1 0x7ffd6819be97 in base::`anonymous namespace’::CreateThreadInternal C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:196 #2 0x7ffd7672e258 in base::internal::WorkerThread::Start C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:207 #3 0x7ffd713e2bf5 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::Flush C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_group.cc:93 #4 0x7ffd713e262d in base::internal::ThreadGroup::BaseScopedCommandsExecutor::~BaseScopedCommandsExecutor C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_group.cc:84 #5 0x7ffd713ff8a2 in base::internal::ThreadGroupImpl::ScopedCommandsExecutor::~ScopedCommandsExecutor C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_group_impl.cc:49 #6 0x7ffd713ff5be in base::internal::ThreadGroupImpl::Start C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_group_impl.cc:248 #7 0x7ffd6c98d9b8 in base::internal::ThreadPoolImpl::Start C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_pool_impl.cc:190 #8 0x7ffd6b75f97a in content::ChildProcess::ChildProcess C:\b\s\w\ir\cache\builder\src\content\child\child_process.cc:102 #9 0x7ffd75c05848 in content::RenderProcess::RenderProcess C:\b\s\w\ir\cache\builder\src\content\renderer\render_process.cc:18 #10 0x7ffd7052c8ea in content::RenderProcessImpl::RenderProcessImpl C:\b\s\w\ir\cache\builder\src\content\renderer\render_process_impl.cc:113 #11 0x7ffd7052cfe5 in content::RenderProcessImpl::Create C:\b\s\w\ir\cache\builder\src\content\renderer\render_process_impl.cc:228 #12 0x7ffd6bd87092 in content::RendererMain C:\b\s\w\ir\cache\builder\src\content\renderer\renderer_main.cc:289 #13 0x7ffd66675dd1 in content::RunOtherNamedProcessTypeMain C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:795 #14 0x7ffd6667802f in content::ContentMainRunnerImpl::Run C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1164 #15 0x7ffd6666c635 in content::RunContentProcess C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:356 #16 0x7ffd6666d1dd in content::ContentMain C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:369 #17 0x7ffd57f916b0 in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:231 #18 0x7ff7302c43ed in MainDllLoader::Launch C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201 #19 0x7ff7302c200c in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:351 #20 0x7ff7306e68cb in __scrt_common_main_seh D:\a_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288 #21 0x7ffdcc44257c in BaseThreadInitThunk+0x1c (C:\Windows\System32\KERNEL32.DLL+0x18001257c) #22 0x7ffdcd62af27 in RtlUserThreadStart+0x27 (C:\Windows\SYSTEM32\ntdll.dll+0x18005af27)
Thread T9 created by T0 here: #0 0x7ff730395252 in CreateThread C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_win.cpp:158 #1 0x7ffd6819be97 in base::`anonymous namespace’::CreateThreadInternal C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:196 #2 0x7ffd6823672e in base::SimpleThread::StartAsync C:\b\s\w\ir\cache\builder\src\base\threading\simple_thread.cc:55 #3 0x7ffd65b16c88 in blink::Thread::CreateAndSetCompositorThread C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\scheduler\common\thread.cc:84 #4 0x7ffd705376d4 in content::RenderThreadImpl::InitializeCompositorThread C:\b\s\w\ir\cache\builder\src\content\renderer\render_thread_impl.cc:837 #5 0x7ffd7053361b in content::RenderThreadImpl::InitializeWebKit C:\b\s\w\ir\cache\builder\src\content\renderer\render_thread_impl.cc:872 #6 0x7ffd7052ff01 in content::RenderThreadImpl::Init C:\b\s\w\ir\cache\builder\src\content\renderer\render_thread_impl.cc:564 #7 0x7ffd70532b8d in content::RenderThreadImpl::RenderThreadImpl C:\b\s\w\ir\cache\builder\src\content\renderer\render_thread_impl.cc:518 #8 0x7ffd6bd87103 in content::RendererMain C:\b\s\w\ir\cache\builder\src\content\renderer\renderer_main.cc:293 #9 0x7ffd66675dd1 in content::RunOtherNamedProcessTypeMain C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:795 #10 0x7ffd6667802f in content::ContentMainRunnerImpl::Run C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1164 #11 0x7ffd6666c635 in content::RunContentProcess C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:356 #12 0x7ffd6666d1dd in content::ContentMain C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:369 #13 0x7ffd57f916b0 in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:231 #14 0x7ff7302c43ed in MainDllLoader::Launch C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201 #15 0x7ff7302c200c in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:351 #16 0x7ff7306e68cb in __scrt_common_main_seh D:\a_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288 #17 0x7ffdcc44257c in BaseThreadInitThunk+0x1c (C:\Windows\System32\KERNEL32.DLL+0x18001257c) #18 0x7ffdcd62af27 in RtlUserThreadStart+0x27 (C:\Windows\SYSTEM32\ntdll.dll+0x18005af27)
SUMMARY: AddressSanitizer: heap-use-after-free C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:2469 in cc::GpuImageDecodeCache::DecodeImageIfNecessary Shadow bytes around the buggy address: 0x11fe92769680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x11fe92769900: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769b00: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa 0x11fe92769b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb
==1472==ADDITIONAL INFO
==1472==Note: Please include this section with the ASan report. Task trace: #0 0x7ffd76f7a874 in cc::ImageController::ScheduleImageDecodeOnWorkerIfNeeded C:\b\s\w\ir\cache\builder\src\cc\tiles\image_controller.cc:402 #1 0x7ffd6dc2e877 in cc::ProxyMain::SetLayerTreeFrameSink C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_main.cc:542 #2 0x7ffd72310385 in cc::ProxyImpl::ScheduledActionBeginLayerTreeFrameSinkCreation C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_impl.cc:877 #3 0x7ffd6dc2c1c5 in cc::ProxyMain::BeginMainFrame C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_main.cc:468
MiraclePtr Status: NOT PROTECTED No raw_ptr<T> access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.
==1472==END OF ADDITIONAL INFO ==1472==ABORTING
- https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md
- https://source.chromium.org/chromium/chromium/src/+/main:cc/tiles/gpu_image_decode_cache.cc;drc=a150b50c0ff706af12c449c7fccd3cf2745e2061;l=1310
- https://source.chromium.org/chromium/chromium/src/+/main:cc/tiles/gpu_image_decode_cache.cc;drc=a150b50c0ff706af12c449c7fccd3cf2745e2061;l=1397
- https://source.chromium.org/chromium/chromium/src/+/main:cc/tiles/gpu_image_decode_cache.cc;drc=a150b50c0ff706af12c449c7fccd3cf2745e2061;l=1401
- https://source.chromium.org/chromium/chromium/src/+/main:cc/tiles/gpu_image_decode_cache.cc;drc=a150b50c0ff706af12c449c7fccd3cf2745e2061;l=2151
- https://source.chromium.org/chromium/chromium/src/+/main:cc/tiles/gpu_image_decode_cache.cc;drc=a150b50c0ff706af12c449c7fccd3cf2745e2061;l=2359
- https://source.chromium.org/chromium/chromium/src/+/main:cc/tiles/gpu_image_decode_cache.cc;drc=a150b50c0ff706af12c449c7fccd3cf2745e2061;l=2407
- https://source.chromium.org/chromium/chromium/src/+/main:cc/tiles/gpu_image_decode_cache.cc;drc=a150b50c0ff706af12c449c7fccd3cf2745e2061;l=2425