PatchGap
Chrome · PrivateAI › Legion

CVE-2026-5874

UAF in PrivateAI (Legion)
Medium watch CVSS 9.6 chrome UAF 📄 Reporter bug report 🔧 Commit mapped

Overview

Medium
Severity
9.6
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUse after free in PrivateAI
DescriptionUse after free in PrivateAI
ComponentPrivateAI
Sub-componentLegion
Bug ClassUAF
Action tierwatch — corruption primitive but gated (uncommon) — not default-reachable
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.
Tracker485397279
Fix commite9d98e66790f (chromium/src) +51/-7
CWECWE-416 (Use-after-free)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CISA KEVNot listed
CreditedKrace
Reported2026-02-18 · bounty $11000 (per vendor advisory)
Fix landed2026-02-19 (public git)
Disclosed2026-04-07
Patch gap47 days — fix public in source before the advisory

Background

`ClientImpl`
the components/private_ai class that owns a Connection (held in connection_) and drives PrivateAI requests such as SendTextRequest.
`Connection`
an owned object (stored as std::unique_ptr<Connection> connection_) that notifies its owner of disconnection through a callback.
`ClientImpl::OnConnectionDisconnected`
the callback the Connection invokes when it drops, and the function the patch rewrites.
Synchronous destruction inside a callback
calling std::unique_ptr::reset() on an object while running code that the same object dispatched, which frees it while frames/iterators still owned by it are live.

Root Cause Analysis

When a Connection disconnected, it invoked ClientImpl::OnConnectionDisconnected, which immediately called connection_.reset(). Because that callback runs within the disconnection-notification flow originating from the Connection object itself, resetting the unique_ptr destroyed the Connection while control was still unwinding through its own call stack, so any subsequent access to the freed Connection (by the notifying code after the callback returns, or by state it still references) is a use-after-free.

The fix preserves the invariant that an object must not be destroyed while a frame belonging to it is still executing: instead of freeing synchronously, OnConnectionDisconnected now std::moves connection_ into a base::BindOnce closure and posts it to the current base::SequencedTaskRunner via PostTask, so the Connection is destroyed only after the current task (and the full disconnect call chain) has returned to the task loop. The regression test ClientImplTest.AsyncDisconnect encodes exactly this: after SimulateDisconnectAndDestroyConnection, destruction must NOT have happened yet (EXPECT_FALSE(destroyed_future.IsReady())) and only occurs once pending tasks run.

Key insight
The single mistake was freeing the Connection synchronously inside the very callback the Connection triggered, destroying an object while its own stack frames were still live; the fix defers the free by posting std::move(connection_) to the sequence’s task runner so destruction happens after the callback unwinds.

Attack Path

  1. Establish a PrivateAI connection An attacker-influenced feature path causes ClientImpl to create and own a Connection through its connection_ member (e.g., after a request such as SendTextRequest).
  2. Trigger a disconnect The underlying Connection is made to disconnect, causing it to invoke ClientImpl::OnConnectionDisconnected from within its own notification flow.
  3. Synchronous free of the live object The pre-patch connection_.reset() destroys the Connection while the disconnect call chain that owns live frames referencing it is still unwinding.
  4. Use-after-free access Code that continues to execute after the callback returns dereferences the now-freed Connection, yielding a use-after-free (inferred — the diff shows the premature free and the async fix, not the specific downstream dereference site).

Impact Assessment

An attacker who can drive a PrivateAI Connection to disconnect can cause a use-after-free of the Connection object in the process hosting components/private_ai; the advisory rates this medium severity and reports no exploited-in-the-wild status. Exploitation beyond the memory-corruption primitive — controlled read/write, information disclosure, or code execution — is (inferred) and not demonstrated by the patch, which only shows the premature destruction and its deferral.

Changed Functions

FunctionChangeNotes
TEST_F
components/private_ai/client_impl_unittest.cc
 modified
if
components/private_ai/testing/fake_connection.cc
 modified

Files Changed

  • components/private_ai/client_impl.cc
  • components/private_ai/client_impl_unittest.cc
  • components/private_ai/testing/fake_connection.cc
  • components/private_ai/testing/fake_connection.h

Audit Directions

  • Synchronous `reset()`/`delete` inside owned-object callbacks
    Audit any handler invoked by a member-owned object (disconnect, close, error, completion callbacks) that destroys that object synchronously via unique_ptr::reset(), delete, or clearing a container; defer the free with a posted task instead.
  • Self-triggered destruction in Chrome `//components` clients
    Review other components/private_ai and sibling client/Connection pairs where a notification flow originating from the callee reaches back into the owner and frees the callee mid-stack.
  • Lifetime of objects passed to `base::BindOnce`/`PostTask` reorderings
    Where a fix moves ownership into a posted closure, verify no other code path still assumes the object is already gone (or still alive) at the original synchronous point, to avoid double-free or late-use regressions.

Patch

view commit
diff --git a/components/private_ai/client_impl.cc b/components/private_ai/client_impl.cc
index 93fcbf9..585db515 100644
--- a/components/private_ai/client_impl.cc
+++ b/components/private_ai/client_impl.cc
@@ -4,6 +4,7 @@
 
 #include "components/private_ai/client_impl.h"
 
+#include <memory>
 #include <string>
 #include <utility>
 
@@ -180,7 +181,14 @@
 void ClientImpl::OnConnectionDisconnected() {
   logger_->LogInfo(FROM_HERE,
                    "Connection disconnected. Destroying connection.");
-  connection_.reset();
+
+  base::SequencedTaskRunner::GetCurrentDefault()->PostTask(
+      FROM_HERE, base::BindOnce(
+                     [](std::unique_ptr<Connection> connection) {
+                       // Release the connection asynchronously to avoid
+                       // use-after-free inside this callback.
+                     },
+                     std::move(connection_)));
 }
 
 }  // namespace private_ai
diff --git a/components/private_ai/client_impl_unittest.cc b/components/private_ai/client_impl_unittest.cc
index a9df39de..4d29dd3 100644
--- a/components/private_ai/client_impl_unittest.cc
+++ b/components/private_ai/client_impl_unittest.cc
@@ -31,8 +31,8 @@
 
   std::unique_ptr<Connection> Create(
       base::RepeatingClosure on_disconnect) override {
-    auto connection =
-        std::make_unique<FakeConnection>(std::move(on_disconnect));
+    auto connection = std::make_unique<FakeConnection>(
+        std::move(on_disconnect), std::move(on_destruction_));
     last_connection_ = connection.get();
     return connection;
   }
@@ -42,6 +42,10 @@
     return last_connection_;
   }
 
+  void set_on_destruction(base::OnceClosure on_destruction) {
+    on_destruction_ = std::move(on_destruction);
+  }
+
   void SimulateDisconnectAndDestroyConnection() {
     CHECK(last_connection_);
 
@@ -55,6 +59,7 @@
 
  private:
   raw_ptr<FakeConnection> last_connection_;
+  base::OnceClosure on_destruction_;
 };
 
 void ResolvePendingRequest(
@@ -218,4 +223,26 @@
   EXPECT_EQ(result.error(), ErrorCode::kNoResponse);
 }
 
+// Test that the connection is destroyed asynchronously after a disconnect.
+TEST_F(ClientImplTest, AsyncDisconnect) {
+  base::test::TestFuture<void> destroyed_future;
+  factory_->set_on_destruction(destroyed_future.GetCallback());
+
+  base::test::TestFuture<base::expected<std::string, ErrorCode>> future;
+  client_->SendTextRequest(proto::FeatureName::FEATURE_NAME_UNSPECIFIED,
+                           "some text", future.GetCallback(), /*options=*/{});
+
+  auto* connection = factory_->last_connection();
+  ASSERT_TRUE(connection);
+
+  // Simulate disconnect.
+  factory_->SimulateDisconnectAndDestroyConnection();
+
+  // The connection should not be destroyed immediately.
+  EXPECT_FALSE(destroyed_future.IsReady());
+
+  // Running pending tasks should destroy the connection.
+  EXPECT_TRUE(destroyed_future.Wait());
+}
+
 }  // namespace private_ai
diff --git a/components/private_ai/testing/fake_connection.cc b/components/private_ai/testing/fake_connection.cc
index 04d8588..84da3fe 100644
--- a/components/private_ai/testing/fake_connection.cc
+++ b/components/private_ai/testing/fake_connection.cc
@@ -22,10 +22,16 @@
 
 FakeConnection::PendingRequest::~PendingRequest() = default;
 
-FakeConnection::FakeConnection(base::OnceClosure on_disconnect)
-    : on_disconnect_(std::move(on_disconnect)) {}
+FakeConnection::FakeConnection(base::OnceClosure on_disconnect,
+                               base::OnceClosure on_destruction)
+    : on_disconnect_(std::move(on_disconnect)),
+      on_destruction_(std::move(on_destruction)) {}
 
-FakeConnection::~FakeConnection() = default;
+FakeConnection::~FakeConnection() {
+  if (on_destruction_) {
+    std::move(on_destruction_).Run();
+  }
+}
 
 void FakeConnection::Send(proto::LegionRequest request,
                           base::TimeDelta timeout,
diff --git a/components/private_ai/testing/fake_connection.h b/components/private_ai/testing/fake_connection.h
index 7dfce47..426771dd 100644
--- a/components/private_ai/testing/fake_connection.h
+++ b/components/private_ai/testing/fake_connection.h
@@ -8,6 +8,7 @@
 #include <vector>
 
 #include "base/functional/callback.h"
+#include "base/functional/callback_helpers.h"
 #include "base/time/time.h"
 #include "components/private_ai/connection.h"
 #include "components/private_ai/error_code.h"
@@ -33,7 +34,8 @@
     OnRequestCallback callback;
   };
 
-  explicit FakeConnection(base::OnceClosure on_disconnect);
+  explicit FakeConnection(base::OnceClosure on_disconnect,
+                          base::OnceClosure on_destruction = {});
   ~FakeConnection() override;
 
   // Connection implementation:
@@ -49,6 +51,7 @@
 
  private:
   base::OnceClosure on_disconnect_;
+  base::OnceClosure on_destruction_;
   std::vector<PendingRequest> pending_requests_;
 };
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/components/private_ai/client_impl_unittest.cc b/components/private_ai/client_impl_unittest.cc
index a9df39de..4d29dd3 100644
--- a/components/private_ai/client_impl_unittest.cc
+++ b/components/private_ai/client_impl_unittest.cc
@@ -31,8 +31,8 @@
 
   std::unique_ptr<Connection> Create(
       base::RepeatingClosure on_disconnect) override {
-    auto connection =
-        std::make_unique<FakeConnection>(std::move(on_disconnect));
+    auto connection = std::make_unique<FakeConnection>(
+        std::move(on_disconnect), std::move(on_destruction_));
     last_connection_ = connection.get();
     return connection;
   }
@@ -42,6 +42,10 @@
     return last_connection_;
   }
 
+  void set_on_destruction(base::OnceClosure on_destruction) {
+    on_destruction_ = std::move(on_destruction);
+  }
+
   void SimulateDisconnectAndDestroyConnection() {
     CHECK(last_connection_);
 
@@ -55,6 +59,7 @@
 
  private:
   raw_ptr<FakeConnection> last_connection_;
+  base::OnceClosure on_destruction_;
 };
 
 void ResolvePendingRequest(
@@ -218,4 +223,26 @@
   EXPECT_EQ(result.error(), ErrorCode::kNoResponse);
 }
 
+// Test that the connection is destroyed asynchronously after a disconnect.
+TEST_F(ClientImplTest, AsyncDisconnect) {
+  base::test::TestFuture<void> destroyed_future;
+  factory_->set_on_destruction(destroyed_future.GetCallback());
+
+  base::test::TestFuture<base::expected<std::string, ErrorCode>> future;
+  client_->SendTextRequest(proto::FeatureName::FEATURE_NAME_UNSPECIFIED,
+                           "some text", future.GetCallback(), /*options=*/{});
+
+  auto* connection = factory_->last_connection();
+  ASSERT_TRUE(connection);
+
+  // Simulate disconnect.
+  factory_->SimulateDisconnectAndDestroyConnection();
+
+  // The connection should not be destroyed immediately.
+  EXPECT_FALSE(destroyed_future.IsReady());
+
+  // Running pending tasks should destroy the connection.
+  EXPECT_TRUE(destroyed_future.Wait());
+}
+
 }  // namespace private_ai
diff --git a/components/private_ai/testing/fake_connection.cc b/components/private_ai/testing/fake_connection.cc
index 04d8588..84da3fe 100644
--- a/components/private_ai/testing/fake_connection.cc
+++ b/components/private_ai/testing/fake_connection.cc
@@ -22,10 +22,16 @@
 
 FakeConnection::PendingRequest::~PendingRequest() = default;
 
-FakeConnection::FakeConnection(base::OnceClosure on_disconnect)
-    : on_disconnect_(std::move(on_disconnect)) {}
+FakeConnection::FakeConnection(base::OnceClosure on_disconnect,
+                               base::OnceClosure on_destruction)
+    : on_disconnect_(std::move(on_disconnect)),
+      on_destruction_(std::move(on_destruction)) {}
 
-FakeConnection::~FakeConnection() = default;
+FakeConnection::~FakeConnection() {
+  if (on_destruction_) {
+    std::move(on_destruction_).Run();
+  }
+}
 
 void FakeConnection::Send(proto::LegionRequest request,
                           base::TimeDelta timeout,
diff --git a/components/private_ai/testing/fake_connection.h b/components/private_ai/testing/fake_connection.h
index 7dfce47..426771dd 100644
--- a/components/private_ai/testing/fake_connection.h
+++ b/components/private_ai/testing/fake_connection.h
@@ -8,6 +8,7 @@
 #include <vector>
 
 #include "base/functional/callback.h"
+#include "base/functional/callback_helpers.h"
 #include "base/time/time.h"
 #include "components/private_ai/connection.h"
 #include "components/private_ai/error_code.h"
@@ -33,7 +34,8 @@
     OnRequestCallback callback;
   };
 
-  explicit FakeConnection(base::OnceClosure on_disconnect);
+  explicit FakeConnection(base::OnceClosure on_disconnect,
+                          base::OnceClosure on_destruction = {});
   ~FakeConnection() override;
 
   // Connection implementation:
@@ -49,6 +51,7 @@
 
  private:
   base::OnceClosure on_disconnect_;
+  base::OnceClosure on_destruction_;
   std::vector<PendingRequest> pending_requests_;
 };
Loading diff…

Original Bug Report

reported by [email protected]

Security: Heap-use-after-free in SecureChannelImpl::OnDecryptedResponse

Steps to reproduce the problem

  1. apply the change.txt to the newest Chromium and compile chrome with ASAN
  2. Run chrome with : ./chrome --user-data-dir=/tmp/noexist --enable-features=ZeroStateSuggestionsUseLegion,Legion
  3. Move mouse to the “Ask Gemini” button. (Don’t need to click)

Note that this UAF can be exploited to escape the sandbox without requiring a compromised renderer. The patch I provided only simulates a successful decryption operation to trigger the callback, and does not affect Chromium’s original logic

Bisect This UAF is introduced in this commit: https://chromium-review.googlesource.com/c/chromium/src/+/7139550 According to the commit, this UAF affects Chrome Stable 144.0.7559.59.

Problem Description

Vulnerability Analysis

In the SecureChannleImpl class, response_callback_ deletes the SecureChannleImpl instance itself [1]. Therefore, any reference to |this| after invoking the callback will result in a use-after-free vulnerability.

[1]

void SecureChannelImpl::OnDecryptedResponse(
    const std::optional<Request>& decrypted_response) {
  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);

  if (!decrypted_response.has_value()) {
    DLOG(ERROR) << "Failed to decrypt response.";
    FailAllRequestsAndClose(ErrorCode::kDecryptionFailed);
    return;
  }
  DVLOG(1) << "Response decrypted successfully.";

  CHECK(response_callback_);
   response_callback_.Run(base::ok(*decrypted_response)); //@audit: the response_callback_ will delete |this|

  ProcessPendingEncryptionRequests(); 
}

void SecureChannelImpl::ProcessPendingEncryptionRequests() {
  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);

  DCHECK_EQ(state_, State::kEstablished);
  if (state_ != State::kEstablished) { //@audit: use after |this| hase been deleted
    return;
  }

SecureChannelImpl is owned by a std::unique_ptr created by ConnectionBasic [2], which itself is owned by a std::unique_ptr in ClientImpl [3][4]. This establishes an ownership chain: ClientImpl → ConnectionBasic → SecureChannelImpl.

ConnectionBasic is reset in ClientImpl::OnConnectionDisconnected() [5]. This function is registered as a callback in ConnectionBasic, which in turn passes ConnectionBasic::OnResponseReceived to SecureChannelImpl as a callback. When triggered, this callback ultimately deletes ClientImpl, thereby destroying ConnectionBasic and, consequently, SecureChannelImpl.

[2]

ConnectionBasic::ConnectionBasic(
    std::unique_ptr<SecureChannel::Factory> secure_channel_factory,
    base::OnceClosure on_disconnect)
    : on_disconnect_(std::move(on_disconnect)) {
  CHECK(secure_channel_factory);
  CHECK(on_disconnect_);

  secure_channel_ = secure_channel_factory->Create(base::BindRepeating(
      &ConnectionBasic::OnResponseReceived, weak_factory_.GetWeakPtr()));
  CHECK(secure_channel_);
}

[3]

std::unique_ptr<Connection> CreateBasicMetricsTimeoutConnection(
    const GURL& url,
    network::mojom::NetworkContext* network_context,
    LegionLogger* logger,
    base::OnceClosure on_disconnect) {
  auto connection_basic = std::make_unique<ConnectionBasic>(
      std::make_unique<SecureChannelImpl::FactoryImpl>(url, network_context,
                                                       logger),
      std::move(on_disconnect));

  auto connection_metrics =
      std::make_unique<ConnectionMetrics>(std::move(connection_basic));

  auto connection_timeout =
      std::make_unique<ConnectionTimeout>(std::move(connection_metrics));

  return connection_timeout;
}

[4]

Connection* ClientImpl::GetOrCreateConnection() {
  if (!connection_) {
    connection_ = connection_factory_->Create(base::BindRepeating(
        &ClientImpl::OnConnectionDisconnected, base::Unretained(this)));
  }
  return connection_.get();
}

[5]

void ClientImpl::OnConnectionDisconnected() {
  logger_->LogInfo(FROM_HERE,
                   "Connection disconnected. Destroying connection.");
  connection_.reset();
}

[1] https://source.chromium.org/chromium/chromium/src/+/main:components/legion/secure_channel_impl.cc;l=357 [2] https://source.chromium.org/chromium/chromium/src/+/main:components/legion/connection_basic.cc;l=26 [3] https://source.chromium.org/chromium/chromium/src/+/main:components/legion/connection_factory_impl.cc;l=33 [4] https://source.chromium.org/chromium/chromium/src/+/main:components/legion/client_impl.cc;l=95 [5] https://source.chromium.org/chromium/chromium/src/+/main:components/legion/client_impl.cc;l=183

Summary

Security: Heap-use-after-free in SecureChannelImpl::OnDecryptedResponse

Custom Questions

Type of crash:

browser

Crash state:

================================================================= ==608920==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c1f73a6fca0 at pc 0x5653945f5dc2 bp 0x7ffc213669d0 sp 0x7ffc213669c8 READ of size 4 at 0x7c1f73a6fca0 thread T0 (chrome) #0 0x5653945f5dc1 in legion::SecureChannelImpl::ProcessPendingEncryptionRequests() components/legion/secure_channel_impl.cc:421:7 #1 0x5653945f6ce2 in legion::SecureChannelImpl::OnDecryptedResponse(std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&) components/legion/secure_channel_impl.cc:367:3 #2 0x5653945f8980 in base::internal::Invoker<base::internal::FunctorTraits<void (legion::SecureChannelImpl::&&)(std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&), base::WeakPtrlegion::SecureChannelImpl&&>, base::internal::BindState<true, true, false, void (legion::SecureChannelImpl::)(std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&), base::WeakPtrlegion::SecureChannelImpl>, void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>::RunOnce(base::internal::BindStateBase*, std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&) base/functional/bind_internal.h:740:12 #3 0x565394607987 in base::internal::OnceCallbackHolder<std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&>::Run(std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&) base/functional/callback.h:155:12 #4 0x565394607bc5 in base::internal::Invoker<base::internal::FunctorTraits<void (base::internal::OnceCallbackHolder<std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&>::* const&)(std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&), std::__Cr::unique_ptr<base::internal::OnceCallbackHolder<std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&>, std::__Cr::default_delete<base::internal::OnceCallbackHolder<std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&>>> const&>, base::internal::BindState<true, true, false, void (base::internal::OnceCallbackHolder<std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&>::)(std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&), std::__Cr::unique_ptr<base::internal::OnceCallbackHolder<std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&>, std::__Cr::default_delete<base::internal::OnceCallbackHolder<std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&>>>>, void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>::Run(base::internal::BindStateBase, std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&) base/functional/bind_internal.h:740:12 #5 0x565394603ecb in base::internal::Invoker<base::internal::FunctorTraits<legion::SecureSessionAsyncImpl::Decrypt(oak::session::v1::EncryptedMessage const&, base::OnceCallback<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>)::$_0&&, base::OnceCallback<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>&&>, base::internal::BindState<false, false, false, legion::SecureSessionAsyncImpl::Decrypt(oak::session::v1::EncryptedMessage const&, base::OnceCallback<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>)::$_0, base::OnceCallback<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>>, void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>::RunOnce(base::internal::BindStateBase*, std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&) base/functional/callback.h:155:12 #6 0x565394607212 in mojo::internal::CallbackWithDeleteHelper<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>::Run(std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&) base/functional/callback.h:155:12 #7 0x565394607435 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::internal::CallbackWithDeleteHelper<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>::&&)(std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&), std::__Cr::unique_ptr<mojo::internal::CallbackWithDeleteHelper<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>, std::__Cr::default_delete<mojo::internal::CallbackWithDeleteHelper<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>>>&&>, base::internal::BindState<true, true, false, void (mojo::internal::CallbackWithDeleteHelper<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>::)(std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&), std::__Cr::unique_ptr<mojo::internal::CallbackWithDeleteHelper<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>, std::__Cr::default_delete<mojo::internal::CallbackWithDeleteHelper<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>>>>, void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>::RunOnce(base::internal::BindStateBase*, std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&) base/functional/bind_internal.h:740:12 #8 0x56539461ff5d in legion::mojom::OakSession_Decrypt_ForwardToCallback::Accept(mojo::Message*) base/functional/callback.h:155:12 #9 0x7f4ff243391f in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1079:41 #10 0x7f4ff244a65b in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #11 0x7f4ff2438b64 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #12 0x7f4ff2459c1e in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42 #13 0x7f4ff245844d in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7 #14 0x7f4ff244a65b in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #15 0x7f4ff241eeff in mojo::Connector::DispatchMessage(mojo::ScopedHandleBasemojo::MessageHandle) mojo/public/cpp/bindings/lib/connector.cc:568:49 #16 0x7f4ff242074e in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:629:14 #17 0x7f4ff24201e7 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) mojo/public/cpp/bindings/lib/connector.cc:454:3 #18 0x7f4ff2422dd1 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, base::internal::BindState<true, true, false, void (mojo::Connector::)(char const, unsigned int), base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) base/functional/bind_internal.h:740:12 #19 0x7f4ff242247e in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const & base/functional/callback.h:343:12 #20 0x7f4ff2422234 in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, base::internal::BindState<false, true, false, void ()(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)>>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase, unsigned int, mojo::HandleSignalsState const&) base/functional/bind_internal.h:673:12 #21 0x7f4ff0767430 in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & base/functional/callback.h:343:12 #22 0x7f4ff0766e0b in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:286:14 #23 0x7f4ff0767e74 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::SimpleWatcher::&&)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtrmojo::SimpleWatcher&&, int&&, unsigned int&&, mojo::HandleSignalsState&&>, base::internal::BindState<true, true, false, void (mojo::SimpleWatcher::)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtrmojo::SimpleWatcher, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #24 0x7f4ff1c8d8b2 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #25 0x7f4ff1d0ee2e in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #26 0x7f4ff1d0de06 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:346:40 #27 0x7f4ff1ee2737 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46 #28 0x7f4ff1ee5ee2 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int ()(void), void*) base/message_loop/message_pump_glib.cc:355:43 #29 0x7f4f82e7617c in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5217c) (BuildId: 2c1d2f9d4a08c71a36797aeb246ab7ae377934ea)

0x7c1f73a6fca0 is located 32 bytes inside of 144-byte region [0x7c1f73a6fc80,0x7c1f73a6fd10) freed by thread T0 (chrome) here: #0 0x56539178f4d2 in operator delete(void*, unsigned long) (/home/krace/fuzz/chromium/src/out/ui/chrome+0x67e64d2) (BuildId: 3cd4a8fa4a7bd132) #1 0x5653945e1635 in legion::ConnectionBasic::~ConnectionBasic() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #2 0x5653945e7d07 in legion::ConnectionMetrics::~ConnectionMetrics() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #3 0x5653945edc8c in legion::ConnectionTimeout::~ConnectionTimeout() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #4 0x5653945f0334 in legion::ConnectionTokenAttestation::~ConnectionTokenAttestation() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #5 0x5653945d9f0c in legion::ClientImpl::OnConnectionDisconnected() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #6 0x5653945dd862 in base::internal::Invoker<base::internal::FunctorTraits<void (legion::ClientImpl::* const&)(), legion::ClientImpl*>, base::internal::BindState<true, true, false, void (legion::ClientImpl::)(), base::internal::UnretainedWrapper<legion::ClientImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase) base/functional/bind_internal.h:740:12 #7 0x5653945e20de in legion::ConnectionBasic::HandleDisconnect(legion::ErrorCode) base/functional/callback.h:155:12 #8 0x5653945e0f2d in legion::ConnectionBasic::OnResponseReceived(base::expected<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>, legion::ErrorCode>) components/legion/connection_basic.cc:71:5 #9 0x5653945e297b in void base::internal::DecayedFunctorTraits<void (legion::ConnectionBasic::)(base::expected<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>, legion::ErrorCode>), base::WeakPtrlegion::ConnectionBasic const&>::Invoke<void (legion::ConnectionBasic::)(base::expected<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>, legion::ErrorCode>), base::WeakPtrlegion::ConnectionBasic const&, base::expected<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>, legion::ErrorCode>>(void (legion::ConnectionBasic::)(base::expected<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>, legion::ErrorCode>), base::WeakPtrlegion::ConnectionBasic const&, base::expected<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>, legion::ErrorCode>&&) base/functional/bind_internal.h:740:12 #10 0x5653945e26b2 in base::internal::Invoker<base::internal::FunctorTraits<void (legion::ConnectionBasic:: const&)(base::expected<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>, legion::ErrorCode>), base::WeakPtrlegion::ConnectionBasic const&>, base::internal::BindState<true, true, false, void (legion::ConnectionBasic::)(base::expected<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>, legion::ErrorCode>), base::WeakPtrlegion::ConnectionBasic>, void (base::expected<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>, legion::ErrorCode>)>::Run(base::internal::BindStateBase, base::expected<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>, legion::ErrorCode>&&) base/functional/bind_internal.h:956:5 #11 0x5653945f712f in base::RepeatingCallback<void (base::expected<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>, legion::ErrorCode>)>::Run(base::expected<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>, legion::ErrorCode>) const & base/functional/callback.h:343:12 #12 0x5653945f6ca5 in legion::SecureChannelImpl::OnDecryptedResponse(std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&) components/legion/secure_channel_impl.cc:365:22 #13 0x5653945f8980 in base::internal::Invoker<base::internal::FunctorTraits<void (legion::SecureChannelImpl::&&)(std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&), base::WeakPtrlegion::SecureChannelImpl&&>, base::internal::BindState<true, true, false, void (legion::SecureChannelImpl::)(std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&), base::WeakPtrlegion::SecureChannelImpl>, void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>::RunOnce(base::internal::BindStateBase*, std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&) base/functional/bind_internal.h:740:12 #14 0x565394607987 in base::internal::OnceCallbackHolder<std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&>::Run(std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&) base/functional/callback.h:155:12 #15 0x565394607bc5 in base::internal::Invoker<base::internal::FunctorTraits<void (base::internal::OnceCallbackHolder<std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&>::* const&)(std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&), std::__Cr::unique_ptr<base::internal::OnceCallbackHolder<std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&>, std::__Cr::default_delete<base::internal::OnceCallbackHolder<std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&>>> const&>, base::internal::BindState<true, true, false, void (base::internal::OnceCallbackHolder<std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&>::)(std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&), std::__Cr::unique_ptr<base::internal::OnceCallbackHolder<std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&>, std::__Cr::default_delete<base::internal::OnceCallbackHolder<std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&>>>>, void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>::Run(base::internal::BindStateBase, std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&) base/functional/bind_internal.h:740:12 #16 0x565394603ecb in base::internal::Invoker<base::internal::FunctorTraits<legion::SecureSessionAsyncImpl::Decrypt(oak::session::v1::EncryptedMessage const&, base::OnceCallback<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>)::$_0&&, base::OnceCallback<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>&&>, base::internal::BindState<false, false, false, legion::SecureSessionAsyncImpl::Decrypt(oak::session::v1::EncryptedMessage const&, base::OnceCallback<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>)::$_0, base::OnceCallback<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>>, void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>::RunOnce(base::internal::BindStateBase*, std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&) base/functional/callback.h:155:12 #17 0x565394607212 in mojo::internal::CallbackWithDeleteHelper<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>::Run(std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&) base/functional/callback.h:155:12 #18 0x565394607435 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::internal::CallbackWithDeleteHelper<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>::&&)(std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&), std::__Cr::unique_ptr<mojo::internal::CallbackWithDeleteHelper<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>, std::__Cr::default_delete<mojo::internal::CallbackWithDeleteHelper<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>>>&&>, base::internal::BindState<true, true, false, void (mojo::internal::CallbackWithDeleteHelper<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>::)(std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&), std::__Cr::unique_ptr<mojo::internal::CallbackWithDeleteHelper<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>, std::__Cr::default_delete<mojo::internal::CallbackWithDeleteHelper<void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>>>>, void (std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&)>::RunOnce(base::internal::BindStateBase*, std::__Cr::optional<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>> const&) base/functional/bind_internal.h:740:12 #19 0x56539461ff5d in legion::mojom::OakSession_Decrypt_ForwardToCallback::Accept(mojo::Message*) base/functional/callback.h:155:12 #20 0x7f4ff243391f in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1079:41 #21 0x7f4ff244a65b in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #22 0x7f4ff2438b64 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #23 0x7f4ff2459c1e in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42 #24 0x7f4ff245844d in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7 #25 0x7f4ff244a65b in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #26 0x7f4ff241eeff in mojo::Connector::DispatchMessage(mojo::ScopedHandleBasemojo::MessageHandle) mojo/public/cpp/bindings/lib/connector.cc:568:49 #27 0x7f4ff242074e in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:629:14 #28 0x7f4ff24201e7 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) mojo/public/cpp/bindings/lib/connector.cc:454:3 #29 0x7f4ff2422dd1 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, base::internal::BindState<true, true, false, void (mojo::Connector::)(char const, unsigned int), base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) base/functional/bind_internal.h:740:12

previously allocated by thread T0 (chrome) here: #0 0x56539178e8cd in operator new(unsigned long) (/home/krace/fuzz/chromium/src/out/ui/chrome+0x67e58cd) (BuildId: 3cd4a8fa4a7bd132) #1 0x5653945f3b60 in legion::SecureChannelImpl::FactoryImpl::Create(base::RepeatingCallback<void (base::expected<std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>, legion::ErrorCode>)>) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26 #2 0x5653945e0692 in legion::ConnectionBasic::ConnectionBasic(std::__Cr::unique_ptr<legion::SecureChannel::Factory, std::__Cr::default_deletelegion::SecureChannel::Factory>, base::OnceCallback<void ()>) components/legion/connection_basic.cc:26:45 #3 0x5653945e61f3 in legion::(anonymous namespace)::CreateTokenAttestationConnection(GURL const&, legion::phosphor::TokenManager*, base::RepeatingCallback<void ()>, network::mojom::NetworkContext*) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30 #4 0x5653945e5f14 in legion::TokenConnectionFactoryImpl::Create(base::RepeatingCallback<void ()>) components/legion/connection_factory_impl.cc:101:10 #5 0x5653945d9c96 in legion::ClientImpl::GetOrCreateConnection() components/legion/client_impl.cc:90:40 #6 0x5653945d98dd in legion::ClientImpl::EstablishSession(base::OnceCallback<void (base::expected<void, legion::ErrorCode>)>) components/legion/client_impl.cc:84:3 #7 0x56539ec13bc6 in TabStripActionContainer::OnGlicButtonHovered() chrome/browser/ui/views/tabs/tab_strip_action_container.cc:99:17 #8 0x56539ec1b8c2 in base::internal::Invoker<base::internal::FunctorTraits<void (TabStripActionContainer::* const&)(), TabStripActionContainer*>, base::internal::BindState<true, true, false, void (TabStripActionContainer::)(), base::internal::UnretainedWrapper<TabStripActionContainer, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase) base/functional/bind_internal.h:740:12 #9 0x565391f2accf in base::RepeatingCallback<void ()>::Run() const & base/functional/callback.h:343:12 #10 0x565397089f4e in glic::TabStripGlicButton::StateChanged(views::Button::ButtonState) chrome/browser/ui/views/tabs/glic/tab_strip_glic_button.cc:475:25 #11 0x7f4fc1dfc1d9 in views::Button::SetState(views::Button::ButtonState) ui/views/controls/button/button.cc:263:3 #12 0x7f4feca86fd4 in ui::ScopedTargetHandler::OnEvent(ui::Event*) ui/events/scoped_target_handler.cc:30:24 #13 0x7f4feca6e308 in ui::EventDispatcher::DispatchEvent(ui::EventHandler*, ui::Event*) ui/events/event_dispatcher.cc:189:12 #14 0x7f4feca6ce6b in ui::EventDispatcher::ProcessEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:138:5 #15 0x7f4feca6c5c4 in ui::EventDispatcherDelegate::DispatchEventToTarget(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:84:14 #16 0x7f4feca6c0fa in ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:56:15 #17 0x7f4fc2100a96 in views::internal::RootView::HandleMouseEnteredOrMoved(ui::MouseEvent const&) ui/views/widget/root_view.cc:912:13 #18 0x7f4fc21320e0 in views::Widget::OnMouseEvent(ui::MouseEvent*) ui/views/widget/widget.cc #19 0x7f4fc2200b95 in views::DesktopNativeWidgetAura::OnMouseEvent(ui::MouseEvent*) ui/views/widget/desktop_aura/desktop_native_widget_aura.cc:1445:30 #20 0x7f4feca6e308 in ui::EventDispatcher::DispatchEvent(ui::EventHandler*, ui::Event*) ui/events/event_dispatcher.cc:189:12 #21 0x7f4feca6ce6b in ui::EventDispatcher::ProcessEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:138:5 #22 0x7f4feca6c5c4 in ui::EventDispatcherDelegate::DispatchEventToTarget(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:84:14 #23 0x7f4feca6c0fa in ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:56:15 #24 0x7f4feca74aaf in ui::EventProcessor::OnEventFromSource(ui::Event*) ui/events/event_processor.cc:72:19 #25 0x7f4feca78051 in ui::EventSource::DeliverEventToSink(ui::Event*) ui/events/event_source.cc:119:16 #26 0x7f4feca779f4 in ui::EventSource::SendEventToSinkFromRewriter(ui::Event const*, ui::EventRewriter const*) ui/events/event_source.cc:134:12 #27 0x7f4fd1706fbd in aura::WindowTreeHostPlatform::DispatchEvent(ui::Event*) ui/aura/window_tree_host_platform.cc:300:38 #28 0x7f4fc2208d38 in views::DesktopWindowTreeHostLinux::DispatchEvent(ui::Event*) ui/views/widget/desktop_aura/desktop_window_tree_host_linux.cc:250:29 #29 0x7f4ff2c31487 in base::internal::Invoker<base::internal::FunctorTraits<void (ui::PlatformWindowDelegate::&&)(ui::Event), ui::PlatformWindowDelegate*>, base::internal::BindState<true, true, false, void (ui::PlatformWindowDelegate::)(ui::Event), base::internal::UnretainedWrapper<ui::PlatformWindowDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (ui::Event*)>::RunOnce(base::internal::BindStateBase*, ui::Event*) base/functional/bind_internal.h:740:12

SUMMARY: AddressSanitizer: heap-use-after-free components/legion/secure_channel_impl.cc:421:7 in legion::SecureChannelImpl::ProcessPendingEncryptionRequests() Shadow bytes around the buggy address: 0x7c1f73a6fa00: f7 fa fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c1f73a6fa80: fd fd fd fa fa fa fa fa fa fa f7 fa fd fd fd fd 0x7c1f73a6fb00: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa 0x7c1f73a6fb80: fa fa fa fa f7 fa fd fd fd fd fd fd fd fd fd fd 0x7c1f73a6fc00: fd fd fd fd fd fd fd fa fa fa fa fa fa fa f7 fa =>0x7c1f73a6fc80: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd 0x7c1f73a6fd00: fd fd fa fa fa fa fa fa f7 fa fd fd fd fd fd fd 0x7c1f73a6fd80: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa 0x7c1f73a6fe00: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd 0x7c1f73a6fe80: fd fd fd fd fd fd fa fa fa fa fa fa f7 fa fd fd 0x7c1f73a6ff00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb

==608920==ADDITIONAL INFO

==608920==Note: Please include this section with the ASan report. Task trace: #0 0x7f4ff076782a in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13

Command line: /home/krace/fuzz/chromium/src/out/ui/chrome --user-data-dir=/tmp/noexist --enable-features=ZeroStateSuggestionsUseLegion,Legion --flag-switches-begin --flag-switches-end --ozone-platform=x11

MiraclePtr Status: NOT PROTECTED No raw_ptr<T> access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==608920==END OF ADDITIONAL INFO

==608920==ABORTING

Reporter credit:

Please only credit: Krace

Additional Data

Category: Security
Chrome Channel: Stable
Regression: N/A \

View on issue tracker
Links in the report
On This Page