IMPORTANT DEBUGGING NOTE: batches of tests are run inside their own process. For debugging a test inside a debugger, use the --gtest_filter= flag along with --single-process-tests. Using sharding settings from environment. This is shard 0/1 Using 1 parallel jobs. Note: Google Test filter = SessionAuthzAuthenticatorTest.UAF_ResumeCallbackDestroysAuthenticatorOnRejection [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from SessionAuthzAuthenticatorTest [ RUN ] SessionAuthzAuthenticatorTest.UAF_ResumeCallbackDestroysAuthenticatorOnRejection ================================================================= ==2752==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c2697c699f8 at pc 0x55b27faa2f61 bp 0x7fff23c92f50 sp 0x7fff23c92f48 READ of size 8 at 0x7c2697c699f8 thread T0 #0 0x55b27faa2f60 in remoting::protocol::SessionAuthzAuthenticator::StartReauthorizerIfNecessary() gen/third_party/libc++/src/include/__memory/unique_ptr.h:275:12 #1 0x55b27faa4635 in remoting::protocol::SessionAuthzAuthenticator::OnVerifiedSessionToken(remoting::JingleAuthentication const&, base::OnceCallback, remoting::HttpStatus const&, std::__Cr::unique_ptr>) remoting/protocol/session_authz_authenticator.cc:249:3 #2 0x55b27faa5384 in base::internal::Invoker, remoting::HttpStatus const&, std::__Cr::unique_ptr>), remoting::protocol::SessionAuthzAuthenticator*, remoting::JingleAuthentication&&, base::OnceCallback&&>, base::internal::BindState, remoting::HttpStatus const&, std::__Cr::unique_ptr>), base::internal::UnretainedWrapper, remoting::JingleAuthentication, base::OnceCallback>, void (remoting::HttpStatus const&, std::__Cr::unique_ptr>)>::RunOnce(base::internal::BindStateBase*, remoting::HttpStatus const&, std::__Cr::unique_ptr>&&) base/functional/bind_internal.h:740:12 #3 0x55b26eac2d83 in base::OnceCallback>)>::Run(remoting::HttpStatus const&, std::__Cr::unique_ptr>) && base/functional/callback.h:155:12 #4 0x55b26eadbcf1 in decltype(auto) auto base::test::RunOnceCallback<1ul, remoting::HttpStatus const&, std::__Cr::unique_ptr>>(remoting::HttpStatus const&, std::__Cr::unique_ptr>&&)::'lambda'(auto&&...)::operator()>, base::OnceCallback>)>>(auto&&...) const base/test/gmock_callback_support.h:46:43 #5 0x55b26eadb7cd in void std::__Cr::__function::__policy_func>, base::OnceCallback>)>)>::__call_func>, base::OnceCallback>)>)>::ActionAdaptor>(std::__Cr::__function::__policy_storage const*, std::__Cr::basic_string_view>&&, base::OnceCallback>)>&&) gen/third_party/libc++/src/include/__functional/function.h:502:12 #6 0x55b27bdd4e19 in testing::internal::FunctionMocker>, base::OnceCallback>)>)>::PerformAction(void const*, std::__Cr::tuple>, base::OnceCallback>)>>&&, std::__Cr::basic_string, std::__Cr::allocator> const&) const gen/third_party/libc++/src/include/__functional/function.h:502:12 #7 0x55b27bdd410e in testing::internal::FunctionMocker>, base::OnceCallback>)>)>::InvokeWith(std::__Cr::tuple>, base::OnceCallback>)>>&&) third_party/googletest/src/googlemock/include/gmock/gmock-spec-builders.h:1869:12 #8 0x55b27bdbf7f2 in remoting::MockSessionAuthzServiceClient::VerifySessionToken(std::__Cr::basic_string_view>, base::OnceCallback>)>) third_party/googletest/src/googlemock/include/gmock/gmock-spec-builders.h:1548:12 #9 0x55b27faa266d in remoting::protocol::SessionAuthzAuthenticator::VerifySessionToken(remoting::JingleAuthentication const&, base::OnceCallback) remoting/protocol/session_authz_authenticator.cc:214:20 #10 0x55b27faa2122 in remoting::protocol::SessionAuthzAuthenticator::ProcessMessage(remoting::JingleAuthentication const&, base::OnceCallback) remoting/protocol/session_authz_authenticator.cc:119:7 #11 0x55b26eac8cba in remoting::protocol::SessionAuthzAuthenticatorTest_UAF_ResumeCallbackDestroysAuthenticatorOnRejection_Test::TestBody() remoting/protocol/session_authz_authenticator_unittest.cc:532:13 #12 0x55b270b4f40b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #13 0x55b270b520b7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #14 0x55b270b541c3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #15 0x55b270b8401a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #16 0x55b270b82a7e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #17 0x55b279ea5ddc in base::TestSuite::Run() base/test/test_suite.cc:440:16 #18 0x55b2736c8561 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #19 0x55b279eb4afb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #20 0x55b279eb441b in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #21 0x55b2736c81ef in main remoting/base/run_all_unittests.cc:60:10 #22 0x7f169951e249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x7c2697c699f8 is located 120 bytes inside of 240-byte region [0x7c2697c69980,0x7c2697c69a70) freed by thread T0 here: #0 0x55b26e6bd002 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/remoting_unittests+0x6264002) (BuildId: bafedb74f7716ac6) #1 0x55b26ead469e in base::internal::Invoker>*&&>, base::internal::BindState>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #2 0x55b27faa9886 in remoting::protocol::Spake2Authenticator::ProcessMessage(remoting::JingleAuthentication const&, base::OnceCallback) base/functional/callback.h:155:12 #3 0x55b27faa462c in remoting::protocol::SessionAuthzAuthenticator::OnVerifiedSessionToken(remoting::JingleAuthentication const&, base::OnceCallback, remoting::HttpStatus const&, std::__Cr::unique_ptr>) remoting/protocol/session_authz_authenticator.cc:248:16 #4 0x55b27faa5384 in base::internal::Invoker, remoting::HttpStatus const&, std::__Cr::unique_ptr>), remoting::protocol::SessionAuthzAuthenticator*, remoting::JingleAuthentication&&, base::OnceCallback&&>, base::internal::BindState, remoting::HttpStatus const&, std::__Cr::unique_ptr>), base::internal::UnretainedWrapper, remoting::JingleAuthentication, base::OnceCallback>, void (remoting::HttpStatus const&, std::__Cr::unique_ptr>)>::RunOnce(base::internal::BindStateBase*, remoting::HttpStatus const&, std::__Cr::unique_ptr>&&) base/functional/bind_internal.h:740:12 #5 0x55b26eac2d83 in base::OnceCallback>)>::Run(remoting::HttpStatus const&, std::__Cr::unique_ptr>) && base/functional/callback.h:155:12 #6 0x55b26eadbcf1 in decltype(auto) auto base::test::RunOnceCallback<1ul, remoting::HttpStatus const&, std::__Cr::unique_ptr>>(remoting::HttpStatus const&, std::__Cr::unique_ptr>&&)::'lambda'(auto&&...)::operator()>, base::OnceCallback>)>>(auto&&...) const base/test/gmock_callback_support.h:46:43 #7 0x55b26eadb7cd in void std::__Cr::__function::__policy_func>, base::OnceCallback>)>)>::__call_func>, base::OnceCallback>)>)>::ActionAdaptor>(std::__Cr::__function::__policy_storage const*, std::__Cr::basic_string_view>&&, base::OnceCallback>)>&&) gen/third_party/libc++/src/include/__functional/function.h:502:12 #8 0x55b27bdd4e19 in testing::internal::FunctionMocker>, base::OnceCallback>)>)>::PerformAction(void const*, std::__Cr::tuple>, base::OnceCallback>)>>&&, std::__Cr::basic_string, std::__Cr::allocator> const&) const gen/third_party/libc++/src/include/__functional/function.h:502:12 #9 0x55b27bdd410e in testing::internal::FunctionMocker>, base::OnceCallback>)>)>::InvokeWith(std::__Cr::tuple>, base::OnceCallback>)>>&&) third_party/googletest/src/googlemock/include/gmock/gmock-spec-builders.h:1869:12 #10 0x55b27bdbf7f2 in remoting::MockSessionAuthzServiceClient::VerifySessionToken(std::__Cr::basic_string_view>, base::OnceCallback>)>) third_party/googletest/src/googlemock/include/gmock/gmock-spec-builders.h:1548:12 #11 0x55b27faa266d in remoting::protocol::SessionAuthzAuthenticator::VerifySessionToken(remoting::JingleAuthentication const&, base::OnceCallback) remoting/protocol/session_authz_authenticator.cc:214:20 #12 0x55b27faa2122 in remoting::protocol::SessionAuthzAuthenticator::ProcessMessage(remoting::JingleAuthentication const&, base::OnceCallback) remoting/protocol/session_authz_authenticator.cc:119:7 #13 0x55b26eac8cba in remoting::protocol::SessionAuthzAuthenticatorTest_UAF_ResumeCallbackDestroysAuthenticatorOnRejection_Test::TestBody() remoting/protocol/session_authz_authenticator_unittest.cc:532:13 #14 0x55b270b4f40b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #15 0x55b270b520b7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #16 0x55b270b541c3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #17 0x55b270b8401a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #18 0x55b270b82a7e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #19 0x55b279ea5ddc in base::TestSuite::Run() base/test/test_suite.cc:440:16 #20 0x55b2736c8561 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #21 0x55b279eb4afb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #22 0x55b279eb441b in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #23 0x55b2736c81ef in main remoting/base/run_all_unittests.cc:60:10 #24 0x7f169951e249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) previously allocated by thread T0 here: #0 0x55b26e6bc3fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/remoting_unittests+0x62633fd) (BuildId: bafedb74f7716ac6) #1 0x55b26eaba655 in remoting::protocol::SessionAuthzAuthenticatorTest::ConfigureAuthenticators(remoting::protocol::CredentialsType) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26 #2 0x55b270b4f2a1 in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #3 0x55b270b520b7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #4 0x55b270b541c3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #5 0x55b270b8401a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #6 0x55b270b82a7e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #7 0x55b279ea5ddc in base::TestSuite::Run() base/test/test_suite.cc:440:16 #8 0x55b2736c8561 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #9 0x55b279eb4afb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #10 0x55b279eb441b in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #11 0x55b2736c81ef in main remoting/base/run_all_unittests.cc:60:10 #12 0x7f169951e249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/libc++/src/include/__memory/unique_ptr.h:275:12 in remoting::protocol::SessionAuthzAuthenticator::StartReauthorizerIfNecessary() Shadow bytes around the buggy address: 0x7c2697c69700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7c2697c69780: 00 00 00 00 00 00 00 00 00 00 00 01 fa fa fa fa 0x7c2697c69800: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x7c2697c69880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c2697c69900: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa =>0x7c2697c69980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd] 0x7c2697c69a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa 0x7c2697c69a80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x7c2697c69b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c2697c69b80: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c2697c69c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==2752==ADDITIONAL INFO ==2752==Note: Please include this section with the ASan report. Task trace: ==2752==END OF ADDITIONAL INFO ==2752==ABORTING