Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SLOW-FUZZING] Seg fault on RTPIncomingSourceGroup::GetSource #42

Closed
murillo128 opened this issue Dec 11, 2018 · 0 comments
Closed

[SLOW-FUZZING] Seg fault on RTPIncomingSourceGroup::GetSource #42

murillo128 opened this issue Dec 11, 2018 · 0 comments

Comments

@murillo128
Copy link
Member

==4269==ERROR: AddressSanitizer: heap-use-after-free on address 0x61c000045900 at pc 0x7f823d5457bc bp 0x7f823d14a250 sp 0x7f823d14a240
READ of size 4 at 0x61c000045900 thread T6
    #0 0x7f823d5457bb in RTPIncomingSourceGroup::GetSource(unsigned int) ../media-server/src/rtp/RTPIncomingSourceGroup.cpp:28
    #1 0x7f823d43c288 in DTLSICETransport::GetIncomingSource(unsigned int) ../media-server/src/DTLSICETransport.cpp:2296
    #2 0x7f823d448820 in DTLSICETransport::onRTCP(std::shared_ptr<RTCPCompoundPacket> const&) ../media-server/src/DTLSICETransport.cpp:1985
    #3 0x7f823d46000c in DTLSICETransport::onData(ICERemoteCandidate const*, unsigned char*, unsigned int) ../media-server/src/DTLSICETransport.cpp:134
    #4 0x7f823d42cc93 in ICERemoteCandidate::onData(unsigned char*, unsigned int) ../media-server/include/ICERemoteCandidate.h:52
    #5 0x7f823d42cc93 in RTPBundleTransport::Read() ../media-server/src/RTPBundleTransport.cpp:533
    #6 0x7f823d42ed17 in RTPBundleTransport::Run() ../media-server/src/RTPBundleTransport.cpp:680
    #7 0x7f823d42eebc in RTPBundleTransport::run(void*) ../media-server/src/RTPBundleTransport.cpp:644
    #8 0x7f8242d707fb in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x77fb)
    #9 0x7f8242a9db5e in clone (/lib/x86_64-linux-gnu/libc.so.6+0x114b5e)

0x61c000045900 is located 128 bytes inside of 1792-byte region [0x61c000045880,0x61c000045f80)
freed by thread T0 here:
    #0 0x7f8243d682d0 in operator delete(void*) (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xe12d0)
    #1 0x7f823d3149fa in _wrap_delete_RTPIncomingSourceGroup ../src/media-server_wrap.cxx:10464
    #2 0xe7a01d in v8::internal::GlobalHandles::DispatchPendingPhantomCallbacks(bool) (/root/.nvm/versions/node/v8.8.1/bin/node+0xe7a01d)
    #3 0xe7a289 in v8::internal::GlobalHandles::PostGarbageCollectionProcessing(v8::internal::GarbageCollector, v8::GCCallbackFlags) (/root/.nvm/versions/node/v8.8.1/bin/node+0xe7a289)
    #4 0xea544d in v8::internal::Heap::PerformGarbageCollection(v8::internal::GarbageCollector, v8::GCCallbackFlags) (/root/.nvm/versions/node/v8.8.1/bin/node+0xea544d)
    #5 0xea6220 in v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) (/root/.nvm/versions/node/v8.8.1/bin/node+0xea6220)
    #6 0xe508c5 in v8::internal::Factory::NewRawOneByteString(int, v8::internal::PretenureFlag) (/root/.nvm/versions/node/v8.8.1/bin/node+0xe508c5)
    #7 0xf55aff in v8::internal::Handle<v8::internal::String> v8::internal::JsonParser<true>::ScanJsonString<false>() (/root/.nvm/versions/node/v8.8.1/bin/node+0xf55aff)
    #8 0xf56d87 in v8::internal::JsonParser<true>::ParseJsonValue() (/root/.nvm/versions/node/v8.8.1/bin/node+0xf56d87)
    #9 0xf56170 in v8::internal::JsonParser<true>::ParseJsonObject() (/root/.nvm/versions/node/v8.8.1/bin/node+0xf56170)
    #10 0xf56d97 in v8::internal::JsonParser<true>::ParseJsonValue() (/root/.nvm/versions/node/v8.8.1/bin/node+0xf56d97)
    #11 0xf57314 in v8::internal::JsonParser<true>::ParseJson() (/root/.nvm/versions/node/v8.8.1/bin/node+0xf57314)
    #12 0xbb30db in v8::internal::Builtin_JsonParse(int, v8::internal::Object**, v8::internal::Isolate*) (/root/.nvm/versions/node/v8.8.1/bin/node+0xbb30db)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant