关键信息 标题: Heap-use-after-free in content::MediaStreamManager::FinalizeEnumerateDevices 状态: Fixed 类型: Vulnerability 优先级: P1 严重性: S1 报告人: cl...@chromium.org 详细报告: 测试用例 漏洞类型: Heap-use-after-free READ 8 详细描述 崩溃类型: Heap-use-after-free READ 8 崩溃地址: 0x608000005e4c8 崩溃状态: - crash stack - content:MediaStreamManager::FinalizeEnumerateDevices - content:MediaStreamManager::DevicesEnumerated - free stack - content:BrowserMessageFilter::Internal::~Internal - IPC::ChannelProxy::Context::OnChannelClosed 最小化测试用例 下载链接 评论 ae...@chromium.org - 渲染器发送MediaStreamHostMsg_GetSources，由DeviceRequestMessageFilter处理 - 渲染器死亡后，DeviceRequestMessageFilter被释放 - 设备枚举完成后，调用DeviceRequestMessageFilter::DevicesEnumerated - 无法重现此问题，但ClusterFuzz似乎能可靠地重现