Issue 128339 in chromium: SSL/TLS WebSocket connection hangs and closing tab leads to crash

[chro...@googlecode.com]

Status: Unconfirmed
Owner: ----
Labels: Type-Bug Pri-2 Area-Undefined OS-Windows

New issue 128339 by tatsuhir...@gmail.com: SSL/TLS WebSocket connection
hangs and closing tab leads to crash
http://code.google.com/p/chromium/issues/detail?id=128339

Chrome Version : 19.0.1084.46
OS Version: 6.1 (Windows 7, Windows Server 2008 R2)
URLs (if applicable) :
Other browsers tested:
Add OK or FAIL after other browsers where you have tested this issue:
Safari 5:
Firefox 4.x:OK
IE 7/8/9:

What steps will reproduce the problem?
1. Connect WebSocket service in SSL/TLS (wss://) in developer tool console.
2. Send message using created WebSocket object and see error:
Error: INVALID_STATE_ERR: DOM Exception 11
3. When tab is closed, chrome crashes

What is the expected result?
WebSocket SSL/TLS Connection should be established and message should be
sent without error.

What happens instead?
WebSocket SSL/TLS Connection hangs and sending message in that conneciton
fails with error: INVALID_STATE_ERR: DOM Exception 11.
Closing tab leads to chrome chrash.


Please provide any additional information below. Attach a screenshot if
possible.

Here is the Event log of the WebSocket SOCKET:

140: SOCKET
wss://localhost:3000/echo
Start Time: 2012-05-16 12:44:49.060

t=1337139889060 [st= 0] +SOCKET_ALIVE [dt=?]
--> source_dependency = 137 (SOCKET_STREAM)
t=1337139889060 [st= 0] +TCP_CONNECT [dt=0]
--> address_list =
["[::1]:3000","127.0.0.1:3000"]
t=1337139889060 [st= 0] TCP_CONNECT_ATTEMPT [dt=0]
--> address = "[::1]:3000"
t=1337139889060 [st= 0] -TCP_CONNECT
--> source_address = "[::1]:49338"
t=1337139889060 [st= 0] +SSL_CONNECT [dt=24]
t=1337139889060 [st= 0] SOCKET_BYTES_SENT
--> byte_count = 177
t=1337139889060 [st= 0] SOCKET_BYTES_RECEIVED
--> byte_count = 681
t=1337139889060 [st= 0] SSL_CERTIFICATES_RECEIVED
--> certificates =
-----BEGIN CERTIFICATE-----

MIICWDCCAcGgAwIBAgIJANs2AyoLFV4iMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNV

BAYTAkpQMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX

aWRnaXRzIFB0eSBMdGQwHhcNMTIwMjA2MTQ1NzAzWhcNMTIwMzA3MTQ1NzAzWjBF

MQswCQYDVQQGEwJKUDETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50

ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB

gQDtSbZ/da2BxNY6JmMzUo7/xG6Jroc8OBBtwiuuEgFJ6Q5uOLwu9aqX/og+g59Z

ajdfS84WkkgMF+nh5yWYP9In8XqGPzS1tDSsYB7rIYP4vb01S3JUbq+qg1t+ctOL

dO0PG5fFd0t8N2TCboFAdnB99MFk1ZqBTc9HMOv/6RcbHwIDAQABo1AwTjAdBgNV

HQ4EFgQU/I3N5SVdA7hGCzv/lfXGtoTRKhwwHwYDVR0jBBgwFoAU/I3N5SVdA7hG

Czv/lfXGtoTRKhwwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQCYMsV6

SIiZSTO6UAX194WeD6IbLxKUpKB6Jc/ID8qZQ2T8s7v6b4ExNgZQTvBqKhpx2hyW

PUB39zCTG/GJL2/ZUQXQ3cDljBBedBrx5tpNRU4R2buLAL/M6u5DOk2drHrTTG+t

h+z7eIoLukA03ifOa1iolJBbhfYVgxsrSgWkWQ==
-----END CERTIFICATE-----

t=1337139889060 [st= 0] +CERT_VERIFIER_REQUEST [dt=24]
t=1337139889060 [st= 0] CERT_VERIFIER_REQUEST_BOUND_TO_JOB
--> source_dependency = 141
(CERT_VERIFIER_JOB)
t=1337139889084 [st= 24] -CERT_VERIFIER_REQUEST
t=1337139889084 [st= 24] -SSL_CONNECT
--> net_error = -202
(ERR_CERT_AUTHORITY_INVALID)
t=1337139889260 [st=200] SOCKET_BYTES_SENT
--> byte_count = 198
t=1337139889261 [st=201] SOCKET_BYTES_RECEIVED
--> byte_count = 250

And then connection hangs.

I used to pywebsocket as the server to reproduce this issue.
The certificate is self-signed as displayed in the above.
Chrome 18 works, but Chrome 19 does not.
Today I installed Debian google-chrome-unstable and it also exhibits this
issue.


UserAgentString: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5
(KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5

[chro...@googlecode.com]

Updates:
Labels: -Area-Undefined Area-WebKit Feature-DevTools Internals-Network-SSL

Comment #1 on issue 128339 by will...@chromium.org: SSL/TLS WebSocket

connection hangs and closing tab leads to crash
http://code.google.com/p/chromium/issues/detail?id=128339

(No comment was entered for this change.)

[chro...@googlecode.com]

Comment #2 on issue 128339 by tatsuhir...@gmail.com: SSL/TLS WebSocket

connection hangs and closing tab leads to crash
http://code.google.com/p/chromium/issues/detail?id=128339

This bug can be reproduced with simple html like this:

<html>
<head>
<script type="text/javascript">
var sock = new window.WebSocket('wss://localhost:3000/echo');
sock.send('hello');
</script>
</head>
<body>
</body>
</html>

Replacing 'localhost' with arbitrary host in wss URI, I think this is a
nasty
bug because the malicious web site can easily crash chrome with simple
scripting.

[chro...@googlecode.com]

Comment #3 on issue 128339 by lu...@mnt.mn: SSL/TLS WebSocket connection

hangs and closing tab leads to crash
http://code.google.com/p/chromium/issues/detail?id=128339

I can confirm this bug on:
Mac OS X 10.8, Chrome 19.0.1084.46
Ruby em-websocket server from https://github.com/igrigorik/em-websocket

Using a configuration like:
EventMachine::WebSocket.start(
:host => "0.0.0.0",
:port => 61614,
:secure => true,
:debug => false,
:tls_options => {
:private_key_file => "shared/cert.pem",
:cert_chain_file => "shared/bundle.pem"
}
)


Connecting to wss://localhost:61614 hangs the tab with 150% CPU usage and
crashes Chrome when trying to close the tab.

I also get the INVALID_STATE_ERR: DOM Exception 11 errors.

[chro...@googlecode.com]

Comment #4 on issue 128339 by a.l...@gmail.com: SSL/TLS WebSocket

connection hangs and closing tab leads to crash
http://code.google.com/p/chromium/issues/detail?id=128339

I can confirm this with Chromium 20.0.1115.1 on Linux x64 using #2's sample
code.

UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/536.9 (KHTML, like Gecko)
Chrome/20.0.1115.1 Safari/536.9

[chro...@googlecode.com]

Comment #5 on issue 128339 by simo...@kazlauskas.me: SSL/TLS WebSocket

connection hangs and closing tab leads to crash
http://code.google.com/p/chromium/issues/detail?id=128339

Could NOT reproduce on

Google Chrome 20.0.1132.8 (Official Build 137054) dev
OS Linux
WebKit 536.11 (@117000)
JavaScript V8 3.10.8.5
Flash (Disabled)
User Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/536.11 (KHTML, like
Gecko) Chrome/20.0.1132.8 Safari/536.11
Command Line /opt/google/chrome/google-chrome --flag-switches-begin
--enable-accelerated-filters --enable-async-dns
--enable-asynchronous-spellchecking --enable-autologin --enable-css-regions
--enable-devtools-experiments --enable-encrypted-media
--enable-extension-activity-ui --enable-http-pipelining
--enable-media-source --enable-media-stream --enable-nacl
--enable-pointer-lock --enable-shadow-dom --enable-spdy3
--enable-style-scoped --enable-video-track
--enable-experimental-extension-apis --focus-existing-tab-on-open
--ignore-gpu-blacklist --enable-per-tile-painting --enable-sync-tabs
--enable-threaded-compositing --webui-task-manager --flag-switches-end

Estabilished connection to 'wss://echo.websocket.org', sent several
messages and no error occured.

[chro...@googlecode.com]

Updates:
Cc: yu...@chromium.org toyos...@chromium.org

Comment #6 on issue 128339 by paulir...@chromium.org: SSL/TLS WebSocket

connection hangs and closing tab leads to crash
http://code.google.com/p/chromium/issues/detail?id=128339

[chro...@googlecode.com]

Updates:
Labels: -Type-Bug Type-Regression Stability-Crash

Comment #7 on issue 128339 by rsl...@chromium.org: SSL/TLS WebSocket

[chro...@googlecode.com]

Comment #12 on issue 128339 by will...@chromium.org: SSL/TLS WebSocket

connection hangs and closing tab leads to crash
http://code.google.com/p/chromium/issues/detail?id=128339

I'm still unclear why the connection hangs, but the tab closing is because
that kills the SocketStreamDispatcherHost, which is the SSLErrorHandler
delegate. So on a certificate error, we delegate to the error handler which
was already deleted, hence we get a use-after-free which usually manifests
as a browser crash. Oops :(

I think there is a 2nd bug here causing an infinite loop trying to connect
a secure WebSocket.