[83374:83374:0419/220859.289915:ERROR:CONSOLE:38] "Unexpected result id 99999", source: chrome://headless/headless_command.js (38)
[83374:83374:0419/220859.960726:ERROR:CONSOLE:38] "Unexpected result id 99999", source: chrome://headless/headless_command.js (38)
<!DOCTYPE html>
<html><head>
<title>COMP-WEB-011 PoC Target Page</title>
</head>
<body>
<h1>hello</h1>
<p>This page serves as the target URL for headless command mode.
The actual trigger is the renderer-side patch that sends a forged
DevTools notification with a mismatched id field.</p>


</body></html>
[83374:83374:0419/220900.058976:ERROR:components/devtools/simple_devtools_protocol_client/simple_devtools_protocol_client.cc:138] Unexpected message id=99999
=================================================================
==83374==ERROR: AddressSanitizer: container-overflow on address 0x7bc624da87c8 at pc 0x562efbd9ff97 bp 0x7ffe0077d6f0 sp 0x7ffe0077d6e8
READ of size 8 at 0x7bc624da87c8 thread T0 (chrome)
    #0 0x562efbd9ff96 in simple_devtools_protocol_client::SimpleDevToolsProtocolClient::DispatchProtocolMessageTask(base::DictValue) base/memory/scoped_refptr.h:264:54
    #1 0x562efbda20e7 in void base::internal::Invoker<base::internal::FunctorTraits<void (simple_devtools_protocol_client::SimpleDevToolsProtocolClient::*&&)(base::DictValue), base::WeakPtr<simple_devtools_protocol_client::SimpleDevToolsProtocolClient>&&, base::DictValue&&>, base::internal::BindState<true, true, false, void (simple_devtools_protocol_client::SimpleDevToolsProtocolClient::*)(base::DictValue), base::WeakPtr<simple_devtools_protocol_client::SimpleDevToolsProtocolClient>, base::DictValue>, void ()>::RunImpl<void (simple_devtools_protocol_client::SimpleDevToolsProtocolClient::*)(base::DictValue), std::__Cr::tuple<base::WeakPtr<simple_devtools_protocol_client::SimpleDevToolsProtocolClient>, base::DictValue>, 0ul, 1ul>(void (simple_devtools_protocol_client::SimpleDevToolsProtocolClient::*&&)(base::DictValue), std::__Cr::tuple<base::WeakPtr<simple_devtools_protocol_client::SimpleDevToolsProtocolClient>, base::DictValue>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul>) base/functional/bind_internal.h:740:12
    #2 0x7f96a9361b59 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #3 0x7f96a93dc1d0 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #4 0x7f96a93db1a6 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #5 0x7f96a95b3927 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #6 0x7f96a95b70e2 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #7 0x7f965cf1bd3a in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x55d3a) (BuildId: c74e800dfd5f72649d673b44292f4a817e45150b)

0x7bc624da87c8 is located 8 bytes inside of 32-byte region [0x7bc624da87c0,0x7bc624da87e0)
allocated by thread T0 (chrome) here:
    #0 0x562eedc172bd in operator new(unsigned long) (/home/test/chromium/src/out/asan-release/chrome+0x681c2bd) (BuildId: d095d037e9fb3bcc)
    #1 0x562efbda3431 in std::__Cr::__wrap_iter<std::__Cr::pair<int, base::OnceCallback<void (base::DictValue)>>*> std::__Cr::vector<std::__Cr::pair<int, base::OnceCallback<void (base::DictValue)>>, std::__Cr::allocator<std::__Cr::pair<int, base::OnceCallback<void (base::DictValue)>>>>::emplace<std::__Cr::pair<int, base::OnceCallback<void (base::DictValue)>>>(std::__Cr::__wrap_iter<std::__Cr::pair<int, base::OnceCallback<void (base::DictValue)>> const*>, std::__Cr::pair<int, base::OnceCallback<void (base::DictValue)>>&&) gen/third_party/libc++/src/include/__new/allocate.h:42:28
    #2 0x562efbda0d1a in simple_devtools_protocol_client::SimpleDevToolsProtocolClient::SendCommand(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, base::DictValue, base::OnceCallback<void (base::DictValue)>) base/containers/flat_tree.h:1054:16
    #3 0x562efbd9a66b in headless::HeadlessCommandHandler::OnDevToolsProtocolExposed(base::DictValue) components/headless/command_handler/headless_command_handler.cc:383:20
    #4 0x562efbd9c780 in base::internal::Invoker<base::internal::FunctorTraits<void (headless::HeadlessCommandHandler::*&&)(base::DictValue), headless::HeadlessCommandHandler*>, base::internal::BindState<true, true, false, void (headless::HeadlessCommandHandler::*)(base::DictValue), base::internal::UnretainedWrapper<headless::HeadlessCommandHandler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (base::DictValue)>::RunOnce(base::internal::BindStateBase*, base::DictValue&&) base/functional/bind_internal.h:740:12
    #5 0x562efbd9faa1 in simple_devtools_protocol_client::SimpleDevToolsProtocolClient::DispatchProtocolMessageTask(base::DictValue) base/functional/callback.h:155:12
    #6 0x562efbda20e7 in void base::internal::Invoker<base::internal::FunctorTraits<void (simple_devtools_protocol_client::SimpleDevToolsProtocolClient::*&&)(base::DictValue), base::WeakPtr<simple_devtools_protocol_client::SimpleDevToolsProtocolClient>&&, base::DictValue&&>, base::internal::BindState<true, true, false, void (simple_devtools_protocol_client::SimpleDevToolsProtocolClient::*)(base::DictValue), base::WeakPtr<simple_devtools_protocol_client::SimpleDevToolsProtocolClient>, base::DictValue>, void ()>::RunImpl<void (simple_devtools_protocol_client::SimpleDevToolsProtocolClient::*)(base::DictValue), std::__Cr::tuple<base::WeakPtr<simple_devtools_protocol_client::SimpleDevToolsProtocolClient>, base::DictValue>, 0ul, 1ul>(void (simple_devtools_protocol_client::SimpleDevToolsProtocolClient::*&&)(base::DictValue), std::__Cr::tuple<base::WeakPtr<simple_devtools_protocol_client::SimpleDevToolsProtocolClient>, base::DictValue>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul>) base/functional/bind_internal.h:740:12
    #7 0x7f96a9361b59 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #8 0x7f96a93dc1d0 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #9 0x7f96a93db1a6 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #10 0x7f96a95b41c9 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:782:48
    #11 0x7f96a93dd823 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #12 0x7f96a92ccc72 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #13 0x7f968a6e7d03 in content::BrowserMainLoop::RunMainMessageLoop() content/browser/browser_main_loop.cc:1103:18
    #14 0x7f968a6eff76 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner_impl.cc:151:15
    #15 0x7f968a6df1b5 in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:32:28
    #16 0x7f968dbbf745 in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:696:10
    #17 0x7f968dbc2e6d in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1320:10
    #18 0x7f968dbc23c6 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1150:12
    #19 0x7f968dbbcae3 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36
    #20 0x7f968dbbce6a in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10
    #21 0x562eedc19215 in ChromeMain chrome/app/chrome_main.cc:194:12
    #22 0x7f9633629d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

HINT: if you don't care about these errors you may set ASAN_OPTIONS=detect_container_overflow=0.
Or if supported by the container library, pass -D__SANITIZER_DISABLE_CONTAINER_OVERFLOW__ to the compiler to disable  instrumentation.
If you suspect a false positive see also: https://github.com/google/sanitizers/wiki/AddressSanitizerContainerOverflow.
SUMMARY: AddressSanitizer: container-overflow base/memory/scoped_refptr.h:264:54 in simple_devtools_protocol_client::SimpleDevToolsProtocolClient::DispatchProtocolMessageTask(base::DictValue)
Shadow bytes around the buggy address:
  0x7bc624da8500: fd fd f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa
  0x7bc624da8580: fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd fd fd
  0x7bc624da8600: f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd
  0x7bc624da8680: fd fd f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa
  0x7bc624da8700: fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd fd fd
=>0x7bc624da8780: f7 fa fd fd fd fd f7 fa fc[fc]fc fc f7 fa fd fd
  0x7bc624da8800: fd fd f7 fa fd fd fd fd f7 fa fd fd fd fa f7 fa
  0x7bc624da8880: fd fd fd fa f7 fa fd fd fd fd f7 fa fd fd fd fd
  0x7bc624da8900: f7 fa fd fd fd fd f7 fa 00 00 00 fa f7 fa 00 00
  0x7bc624da8980: 00 fa f7 fa 00 00 00 00 f7 fa fd fd fd fd f7 fa
  0x7bc624da8a00: fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==83374==ADDITIONAL INFO

==83374==Note: Please include this section with the ASan report.
Task trace:
    #0 0x562efbd9ec6e in simple_devtools_protocol_client::SimpleDevToolsProtocolClient::DispatchProtocolMessage(content::DevToolsAgentHost*, base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) components/devtools/simple_devtools_protocol_client/simple_devtools_protocol_client.cc:113:7
    #1 0x7f969b0b5fc8 in IPC::ChannelAssociatedGroupController::Accept(mojo::Message*) ipc/ipc_mojo_bootstrap.cc:1138:13
    #2 0x7f96a9ecc84a in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13


Command line: `out/asan-release/chrome --headless --dump-dom --incognito --noerrdialogs --no-first-run --user-data-dir=/tmp/org.chromium.Chromium.scoped_dir.ymuORA --ozone-platform=headless --ozone-override-screen-size=800,600 --use-angle=swiftshader-webgl --flag-switches-begin --flag-switches-end --disable-lazy-loading issue_devtools_oob/poc.html`


==83374==END OF ADDITIONAL INFO

==83374==ABORTING