INFO: Running with entropic power schedule (0xFF, 100). INFO: Seed: 3041397354 INFO: Loaded 1 modules (386102 inline 8-bit counters): 386102 [0x651b27ead460, 0x651b27f0b896), INFO: Loaded 1 PC tables (386102 PCs): 386102 [0x651b27f0b898,0x651b284efbf8), ./out/fuzzers/pc_sdp_negotiation_fuzzer: Running 1 inputs 1 time(s) each. Running: /root/findings/pc_sdp_uaf/crash-776f33be82b123e61fbf273d859ad894b77d48f2 (peer_connection_factory.cc:381): Using default network controller factory (bitrate_prober.cc:54): Bandwidth probing enabled, set to inactive (cpu_info.cc:77): Available number of cores: 16 (transport_sequence_number_feedback_generator.cc:52): Maximum interval between transport feedback RTCP messages: 250 ms (aimd_rate_control.cc:88): Using aimd rate control with back off factor 0.85 (remote_bitrate_estimator_single_stream.cc:59): RemoteBitrateEstimatorSingleStream: Instantiating. (peer_connection_factory.cc:381): Using default network controller factory (bitrate_prober.cc:54): Bandwidth probing enabled, set to inactive (transport_sequence_number_feedback_generator.cc:52): Maximum interval between transport feedback RTCP messages: 250 ms (aimd_rate_control.cc:88): Using aimd rate control with back off factor 0.85 (remote_bitrate_estimator_single_stream.cc:59): RemoteBitrateEstimatorSingleStream: Instantiating. (peer_connection.cc:1229): Adding audio transceiver in response to a call to AddTransceiver. (sdp_offer_answer.cc:3472): Called in wrong signalingState: stable (INVALID_STATE) (openssl_key_pair.cc:36): Making key pair (openssl_key_pair.cc:89): Returning key pair (boringssl_certificate.cc:186): Making certificate for WebRTC (boringssl_certificate.cc:242): Returning certificate (openssl_key_pair.cc:36): Making key pair (openssl_key_pair.cc:89): Returning key pair (boringssl_certificate.cc:186): Making certificate for WebRTC (boringssl_certificate.cc:242): Returning certificate (sdp_payload_type_suggester.cc:63): SuggestPayloadType: FAILED to find remote mapping for [101:audio/fake_audio_codec/8000/1] (p2p_transport_channel.cc:560): Set backup connection ping interval to 25 s milliseconds. (p2p_transport_channel.cc:569): Set ICE receiving timeout to 2500 ms milliseconds (p2p_transport_channel.cc:576): Set ping most likely connection to 0 (p2p_transport_channel.cc:583): Set stable_writable_connection_ping_interval to 2500 ms (p2p_transport_channel.cc:596): Set presume writable when fully relayed to 0 (p2p_transport_channel.cc:614): Set regather_on_failed_networks_interval to 300 s (p2p_transport_channel.cc:624): Set receiving_switching_delay to 1 s (jsep_transport_controller.cc:641): Creating DtlsSrtpTransport. (dtls_srtp_transport.cc:53): Setting RTP Transport on 0 transport d51e1c80 (srtp_transport.cc:241): The params in SRTP transport are reset. (p2p_transport_channel.cc:505): Received remote ICE parameters: ufrag=axBQ, renomination disabled (sdp_offer_answer.cc:4268): Adding audio transceiver for MID=0 at i=0 in response to the remote description. (sdp_offer_answer.cc:3247): Session: 7746673842127498859 Old state: stable New state: have-remote-offer (channel.cc:953): Setting remote voice description for {mid: 0, media_type: audio} (channel.cc:785): Add remote ssrc: 2571018193 to {mid: 0, media_type: audio} (channel.cc:876): Changing voice state, recv=0 send=0 for {mid: 0, media_type: audio} (sdp_offer_answer.cc:2400): Processing the MSIDs for MID=0 (streams=[]). (sdp_offer_answer.cc:2410): Processing the addition of a remote track for MID=0. (sdp_offer_answer.cc:3247): Session: 7746673842127498859 Old state: have-remote-offer New state: stable ================================================================= ==2320==ERROR: AddressSanitizer: heap-use-after-free on address 0x7894d51e0788 at pc 0x651b266ee66d bp 0x7fff132939c0 sp 0x7fff132939b8 READ of size 8 at 0x7894d51e0788 thread T0 #0 0x651b266ee66c in void absl::internal_any_invocable::LocalInvoker(absl::internal_any_invocable::TypeErasedState*) pc/rtp_sender.cc:864:5 #1 0x651b2669ca45 in void absl::internal_any_invocable::RemoteInvoker(absl::internal_any_invocable::TypeErasedState*) third_party/abseil-cpp/absl/functional/internal/any_invocable.h:774:1 #2 0x651b266fa6b1 in void webrtc::FunctionView::CallVoidPtr(webrtc::FunctionView::VoidUnion) third_party/abseil-cpp/absl/functional/internal/any_invocable.h:774:1 #3 0x651b25f7b7a1 in webrtc::Thread::BlockingCallImpl(webrtc::FunctionView, webrtc::Location const&) api/function_view.h:96:12 #4 0x651b266f7e48 in webrtc::ScopedOperationsBatcher::Run() rtc_base/thread.h:353:5 #5 0x651b266f79b2 in webrtc::ScopedOperationsBatcher::~ScopedOperationsBatcher() pc/scoped_operations_batcher.cc:33:20 #6 0x651b2684ae8e in webrtc::SdpOfferAnswerHandler::Rollback(webrtc::SdpType) pc/sdp_offer_answer.cc:3599:1 #7 0x651b26845100 in webrtc::SdpOfferAnswerHandler::DoSetLocalDescription(std::__Cr::unique_ptr>, webrtc::scoped_refptr) pc/sdp_offer_answer.cc:2620:47 #8 0x651b268ae156 in webrtc::rtc_operations_chain_internal::OperationWithFunctor>, webrtc::scoped_refptr)::$_1>::Run() pc/sdp_offer_answer.cc:1811:24 #9 0x651b26826349 in webrtc::SdpOfferAnswerHandler::SetLocalDescription(std::__Cr::unique_ptr>, webrtc::scoped_refptr) rtc_base/operations_chain.h:155:36 #10 0x651b2656f835 in void absl::internal_any_invocable::RemoteInvoker>, webrtc::scoped_refptr)::$_0&&>(absl::internal_any_invocable::TypeErasedState*) pc/peer_connection.cc:1576:23 #11 0x651b2652ab28 in webrtc::PeerConnection::RunOnSignalingThread(absl::AnyInvocable) third_party/abseil-cpp/absl/functional/internal/any_invocable.h:774:1 #12 0x651b2652b629 in webrtc::PeerConnection::SetLocalDescription(std::__Cr::unique_ptr>, webrtc::scoped_refptr) pc/peer_connection.cc:1573:3 #13 0x651b263d2714 in webrtc::PeerConnectionProxyWithInternal::SetLocalDescription(std::__Cr::unique_ptr>, webrtc::scoped_refptr) pc/peer_connection_proxy.h:140:22 #14 0x651b25729426 in webrtc::(anonymous namespace)::DoSetLocalRollback(webrtc::(anonymous namespace)::PeerContext&) test/fuzzers/pc_sdp_negotiation_fuzzer.cc:251:12 #15 0x651b257272b4 in webrtc::FuzzOneInput(webrtc::FuzzDataHelper) test/fuzzers/pc_sdp_negotiation_fuzzer.cc:414:9 #16 0x651b257461d3 in LLVMFuzzerTestOneInput test/fuzzers/webrtc_fuzzer_main.cc:44:3 #17 0x651b25782606 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:619:13 #18 0x651b2575490d in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:329:6 #19 0x651b2575d710 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:864:9 #20 0x651b25746325 in main third_party/libFuzzer/src/FuzzerMain.cpp:20:10 #21 0x7b24d602a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb) #22 0x7b24d602a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb) #23 0x651b2564bd69 in _start (/root/webrtc/src/out/fuzzers/pc_sdp_negotiation_fuzzer+0x11c7d69) (BuildId: 9ba461d1504227a5) 0x7894d51e0788 is located 8 bytes inside of 720-byte region [0x7894d51e0780,0x7894d51e0a50) freed by thread T0 here: #0 0x651b25725a72 in operator delete(void*, unsigned long) (/root/webrtc/src/out/fuzzers/pc_sdp_negotiation_fuzzer+0x12a1a72) (BuildId: 9ba461d1504227a5) #1 0x651b266ef22a in non-virtual thunk to webrtc::RefCountedObject::Release() const rtc_base/ref_counted_object.h:42:7 #2 0x651b26564c84 in webrtc::RtpSenderProxyWithInternal::DestroyInternal() api/scoped_refptr.h:129:13 #3 0x651b26564fb8 in webrtc::MethodCall, void>::Marshal(webrtc::Thread*) pc/proxy.h:94:5 #4 0x651b26560ff5 in webrtc::RefCountedObject>::~RefCountedObject() pc/rtp_sender_proxy.h:38:1 #5 0x651b26560b96 in webrtc::RefCountedObject>::Release() const rtc_base/ref_counted_object.h:42:7 #6 0x651b265493c2 in std::__Cr::vector>, std::__Cr::allocator>>>::__destroy_vector::operator()() api/scoped_refptr.h:105:13 #7 0x651b26674bf7 in webrtc::RtpTransceiver::~RtpTransceiver() gen/third_party/libc++/src/include/__vector/vector.h:259:67 #8 0x651b265592e3 in webrtc::RefCountedObject::~RefCountedObject() rtc_base/ref_counted_object.h:56:32 #9 0x651b26559269 in webrtc::RefCountedObject::Release() const rtc_base/ref_counted_object.h:42:7 #10 0x651b265520e4 in webrtc::RtpTransceiverProxyWithInternal::DestroyInternal() api/scoped_refptr.h:129:13 #11 0x651b26552418 in webrtc::MethodCall, void>::Marshal(webrtc::Thread*) pc/proxy.h:94:5 #12 0x651b2654f482 in webrtc::RefCountedObject>::~RefCountedObject() pc/rtp_transceiver.h:552:1 #13 0x651b2654f076 in webrtc::RefCountedObject>::Release() const rtc_base/ref_counted_object.h:42:7 #14 0x651b26732696 in void std::__Cr::__destroy_at> const, webrtc::TransceiverStableState>>(std::__Cr::pair> const, webrtc::TransceiverStableState>*) api/scoped_refptr.h:105:13 #15 0x651b267324a1 in std::__Cr::__tree>, webrtc::TransceiverStableState>, std::__Cr::__map_value_compare>, std::__Cr::pair> const, webrtc::TransceiverStableState>, std::__Cr::less>>>, std::__Cr::allocator> const, webrtc::TransceiverStableState>>>::__tree_deleter::operator()(std::__Cr::__tree_node>, webrtc::TransceiverStableState>, void*>*) gen/third_party/libc++/src/include/__memory/allocator_traits.h:313:5 #16 0x651b2684a882 in webrtc::SdpOfferAnswerHandler::Rollback(webrtc::SdpType) gen/third_party/libc++/src/include/__tree:1361:64 #17 0x651b26845100 in webrtc::SdpOfferAnswerHandler::DoSetLocalDescription(std::__Cr::unique_ptr>, webrtc::scoped_refptr) pc/sdp_offer_answer.cc:2620:47 #18 0x651b268ae156 in webrtc::rtc_operations_chain_internal::OperationWithFunctor>, webrtc::scoped_refptr)::$_1>::Run() pc/sdp_offer_answer.cc:1811:24 #19 0x651b26826349 in webrtc::SdpOfferAnswerHandler::SetLocalDescription(std::__Cr::unique_ptr>, webrtc::scoped_refptr) rtc_base/operations_chain.h:155:36 #20 0x651b2656f835 in void absl::internal_any_invocable::RemoteInvoker>, webrtc::scoped_refptr)::$_0&&>(absl::internal_any_invocable::TypeErasedState*) pc/peer_connection.cc:1576:23 #21 0x651b2652ab28 in webrtc::PeerConnection::RunOnSignalingThread(absl::AnyInvocable) third_party/abseil-cpp/absl/functional/internal/any_invocable.h:774:1 #22 0x651b2652b629 in webrtc::PeerConnection::SetLocalDescription(std::__Cr::unique_ptr>, webrtc::scoped_refptr) pc/peer_connection.cc:1573:3 #23 0x651b263d2714 in webrtc::PeerConnectionProxyWithInternal::SetLocalDescription(std::__Cr::unique_ptr>, webrtc::scoped_refptr) pc/peer_connection_proxy.h:140:22 #24 0x651b25729426 in webrtc::(anonymous namespace)::DoSetLocalRollback(webrtc::(anonymous namespace)::PeerContext&) test/fuzzers/pc_sdp_negotiation_fuzzer.cc:251:12 #25 0x651b257272b4 in webrtc::FuzzOneInput(webrtc::FuzzDataHelper) test/fuzzers/pc_sdp_negotiation_fuzzer.cc:414:9 #26 0x651b257461d3 in LLVMFuzzerTestOneInput test/fuzzers/webrtc_fuzzer_main.cc:44:3 #27 0x651b25782606 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:619:13 #28 0x651b2575490d in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:329:6 #29 0x651b2575d710 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:864:9 previously allocated by thread T0 here: #0 0x651b25724e6d in operator new(unsigned long) (/root/webrtc/src/out/fuzzers/pc_sdp_negotiation_fuzzer+0x12a0e6d) (BuildId: 9ba461d1504227a5) #1 0x651b266dda15 in webrtc::AudioRtpSender::Create(webrtc::Environment const&, webrtc::Thread*, webrtc::Thread*, std::__Cr::basic_string_view>, webrtc::LegacyStatsCollectorInterface*, webrtc::RtpSenderBase::SetStreamsObserver*, webrtc::MediaSendChannelInterface*) api/make_ref_counted.h:90:27 #2 0x651b26695f56 in webrtc::(anonymous namespace)::CreateSender(webrtc::MediaType, webrtc::Environment const&, webrtc::ConnectionContext*, webrtc::LegacyStatsCollectorInterface*, webrtc::RtpSenderBase::SetStreamsObserver*, std::__Cr::basic_string_view>, webrtc::MediaSendChannelInterface*) pc/rtp_transceiver.cc:166:9 #3 0x651b26695367 in void webrtc::FunctionView::CallVoidPtr>, std::__Cr::basic_string_view>, webrtc::MediaType, webrtc::scoped_refptr, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>> const&, std::__Cr::vector> const&, webrtc::ConnectionContext*, webrtc::CodecLookupHelper*, webrtc::LegacyStatsCollectorInterface*, webrtc::RtpSenderBase::SetStreamsObserver*, webrtc::AudioOptions const&, webrtc::VideoOptions const&, webrtc::CryptoOptions const&, webrtc::VideoBitrateAllocatorFactory*, std::__Cr::vector>, absl::AnyInvocable)::$_0>(webrtc::FunctionView::VoidUnion) pc/rtp_transceiver.cc:415:24 #4 0x651b25f7b7a1 in webrtc::Thread::BlockingCallImpl(webrtc::FunctionView, webrtc::Location const&) api/function_view.h:96:12 #5 0x651b266735d3 in webrtc::RtpTransceiver::RtpTransceiver(webrtc::Environment const&, webrtc::Call*, webrtc::MediaConfig const&, std::__Cr::basic_string_view>, std::__Cr::basic_string_view>, webrtc::MediaType, webrtc::scoped_refptr, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>> const&, std::__Cr::vector> const&, webrtc::ConnectionContext*, webrtc::CodecLookupHelper*, webrtc::LegacyStatsCollectorInterface*, webrtc::RtpSenderBase::SetStreamsObserver*, webrtc::AudioOptions const&, webrtc::VideoOptions const&, webrtc::CryptoOptions const&, webrtc::VideoBitrateAllocatorFactory*, std::__Cr::vector>, absl::AnyInvocable) rtc_base/thread.h:353:5 #6 0x651b2672662c in webrtc::RtpTransmissionManager::CreateAndAddTransceiver(webrtc::MediaConfig const&, webrtc::AudioOptions const&, webrtc::VideoOptions const&, webrtc::CryptoOptions const&, webrtc::VideoBitrateAllocatorFactory*, webrtc::MediaType, webrtc::scoped_refptr, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>> const&, std::__Cr::vector> const&, std::__Cr::vector> const&, std::__Cr::basic_string_view>, std::__Cr::basic_string_view>) rtc_base/ref_counted_object.h:33:9 #7 0x651b2686d974 in webrtc::SdpOfferAnswerHandler::AssociateTransceiver(webrtc::ContentSource, webrtc::SdpType, unsigned long, webrtc::ContentInfo const&, webrtc::ContentInfo const*, webrtc::ContentInfo const*) pc/sdp_offer_answer.cc:4281:36 #8 0x651b2682e41a in webrtc::SdpOfferAnswerHandler::UpdateTransceiversAndDataChannels(webrtc::ContentSource, webrtc::SessionDescriptionInterface const&, webrtc::SessionDescriptionInterface const*, webrtc::SessionDescriptionInterface const*, webrtc::flat_map, std::__Cr::allocator>, webrtc::ContentGroup const*, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, webrtc::ContentGroup const*>, std::__Cr::allocator, std::__Cr::allocator>, webrtc::ContentGroup const*>>>> const&) pc/sdp_offer_answer.cc:4141:11 #9 0x651b2683a22d in webrtc::SdpOfferAnswerHandler::RemoteDescriptionOperation::UpdateChannels() pc/sdp_offer_answer.cc:1192:26 #10 0x651b268374e2 in webrtc::SdpOfferAnswerHandler::ApplyRemoteDescription(std::__Cr::unique_ptr>) pc/sdp_offer_answer.cc:2247:19 #11 0x651b26859030 in webrtc::SdpOfferAnswerHandler::DoSetRemoteDescription(std::__Cr::unique_ptr>) pc/sdp_offer_answer.cc:2970:3 #12 0x651b268b114a in webrtc::rtc_operations_chain_internal::OperationWithFunctor>, webrtc::scoped_refptr)::$_1>::Run() pc/sdp_offer_answer.cc:2197:24 #13 0x651b26836be9 in webrtc::SdpOfferAnswerHandler::SetRemoteDescription(std::__Cr::unique_ptr>, webrtc::scoped_refptr) rtc_base/operations_chain.h:155:36 #14 0x651b26570645 in void absl::internal_any_invocable::RemoteInvoker>, webrtc::scoped_refptr)::$_0&&>(absl::internal_any_invocable::TypeErasedState*) pc/peer_connection.cc:1617:23 #15 0x651b2652ab28 in webrtc::PeerConnection::RunOnSignalingThread(absl::AnyInvocable) third_party/abseil-cpp/absl/functional/internal/any_invocable.h:774:1 #16 0x651b2652c4f9 in webrtc::PeerConnection::SetRemoteDescription(std::__Cr::unique_ptr>, webrtc::scoped_refptr) pc/peer_connection.cc:1614:3 #17 0x651b263d2e34 in webrtc::PeerConnectionProxyWithInternal::SetRemoteDescription(std::__Cr::unique_ptr>, webrtc::scoped_refptr) pc/peer_connection_proxy.h:152:22 #18 0x651b25729063 in webrtc::(anonymous namespace)::DoSetRemote(webrtc::(anonymous namespace)::PeerContext&, webrtc::SdpType, std::__Cr::basic_string, std::__Cr::allocator> const&) test/fuzzers/pc_sdp_negotiation_fuzzer.cc:261:12 #19 0x651b257272fb in webrtc::FuzzOneInput(webrtc::FuzzDataHelper) test/fuzzers/pc_sdp_negotiation_fuzzer.cc:405:9 #20 0x651b257461d3 in LLVMFuzzerTestOneInput test/fuzzers/webrtc_fuzzer_main.cc:44:3 #21 0x651b25782606 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:619:13 #22 0x651b2575490d in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:329:6 #23 0x651b2575d710 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:864:9 #24 0x651b25746325 in main third_party/libFuzzer/src/FuzzerMain.cpp:20:10 #25 0x7b24d602a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb) #26 0x7b24d602a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb) #27 0x651b2564bd69 in _start (/root/webrtc/src/out/fuzzers/pc_sdp_negotiation_fuzzer+0x11c7d69) (BuildId: 9ba461d1504227a5) SUMMARY: AddressSanitizer: heap-use-after-free pc/rtp_sender.cc:864:5 in void absl::internal_any_invocable::LocalInvoker(absl::internal_any_invocable::TypeErasedState*) Shadow bytes around the buggy address: 0x7894d51e0500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7894d51e0580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7894d51e0600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7894d51e0680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7894d51e0700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x7894d51e0780: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7894d51e0800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7894d51e0880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7894d51e0900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7894d51e0980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7894d51e0a00: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==2320==ABORTING