Note: Google Test filter = JsepTransportCollectionRollbackUaf.* [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from JsepTransportCollectionRollbackUaf [ RUN ] JsepTransportCollectionRollbackUaf.ShortCircuitLeavesDanglingRtpTransport ================================================================= ==2258==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d32defe0480 at pc 0x55ad9ce551bc bp 0x7fffa2b4b9b0 sp 0x7fffa2b4b9a8 READ of size 8 at 0x7d32defe0480 thread T0 #0 0x55ad9ce551bb in webrtc::(anonymous namespace)::JsepTransportCollectionRollbackUaf_ShortCircuitLeavesDanglingRtpTransport_Test::TestBody() third_party/webrtc/pc/jsep_transport_collection_rollback_uaf_test.cc:161:52 #1 0x55ad9d589ddb in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #2 0x55ad9d58bfd7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #3 0x55ad9d58df43 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #4 0x55ad9d5bda2a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #5 0x55ad9d5bc48e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #6 0x55ad9ce50e3b in main third_party/googletest/src/googletest/include/gtest/gtest.h:2337:73 #7 0x7fb2dfe86249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x7d32defe0480 is located 0 bytes inside of 800-byte region [0x7d32defe0480,0x7d32defe07a0) freed by thread T0 here: #0 0x55ad9ce50102 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/jsep_transport_collection_rollback_uaf_poc+0x75f102) (BuildId: 63396466044e3ca5) #1 0x55ad9d889512 in webrtc::DtlsSrtpTransport::~DtlsSrtpTransport() third_party/webrtc/pc/dtls_srtp_transport.h:32:7 #2 0x55ad9d88cc12 in webrtc::JsepTransport::~JsepTransport() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #3 0x55ad9d891e82 in std::__Cr::vector>, std::__Cr::allocator>>>::__destruct_at_end(std::__Cr::unique_ptr>*) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #4 0x55ad9d890f2a in webrtc::JsepTransportCollection::DestroyUnusedTransports() gen/third_party/libc++/src/include/__vector/vector.h:1163:9 #5 0x55ad9d890af2 in webrtc::JsepTransportCollection::RollbackTransports() third_party/webrtc/pc/jsep_transport_collection.cc:287:3 #6 0x55ad9ce53428 in webrtc::(anonymous namespace)::JsepTransportCollectionRollbackUaf_ShortCircuitLeavesDanglingRtpTransport_Test::TestBody() third_party/webrtc/pc/jsep_transport_collection_rollback_uaf_test.cc:140:24 #7 0x55ad9d589ddb in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #8 0x55ad9d58bfd7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #9 0x55ad9d58df43 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #10 0x55ad9d5bda2a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #11 0x55ad9d5bc48e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #12 0x55ad9ce50e3b in main third_party/googletest/src/googletest/include/gtest/gtest.h:2337:73 #13 0x7fb2dfe86249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) previously allocated by thread T0 here: #0 0x55ad9ce4f4fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/jsep_transport_collection_rollback_uaf_poc+0x75e4fd) (BuildId: 63396466044e3ca5) #1 0x55ad9ce555d0 in webrtc::(anonymous namespace)::MakeJsepTransport(std::__Cr::basic_string, std::__Cr::allocator> const&) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26 #2 0x55ad9ce52756 in webrtc::(anonymous namespace)::JsepTransportCollectionRollbackUaf_ShortCircuitLeavesDanglingRtpTransport_Test::TestBody() third_party/webrtc/pc/jsep_transport_collection_rollback_uaf_test.cc:122:19 #3 0x55ad9d589ddb in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #4 0x55ad9d58bfd7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #5 0x55ad9d58df43 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #6 0x55ad9d5bda2a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #7 0x55ad9d5bc48e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #8 0x55ad9ce50e3b in main third_party/googletest/src/googletest/include/gtest/gtest.h:2337:73 #9 0x7fb2dfe86249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-use-after-free third_party/webrtc/pc/jsep_transport_collection_rollback_uaf_test.cc:161:52 in webrtc::(anonymous namespace)::JsepTransportCollectionRollbackUaf_ShortCircuitLeavesDanglingRtpTransport_Test::TestBody() Shadow bytes around the buggy address: 0x7d32defe0200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7d32defe0280: 00 00 00 00 00 00 01 fc 00 00 00 00 00 00 00 00 0x7d32defe0300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7d32defe0380: 00 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa 0x7d32defe0400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x7d32defe0480:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7d32defe0500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7d32defe0580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7d32defe0600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7d32defe0680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7d32defe0700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==2258==ABORTING