1167320 - DataSourceSurfaceD2D1::Map using uninitialized memory

Status: RESOLVED DUPLICATE of bug 1167356

(Core :: Graphics, defect)

Description

[q1]

User Agent: Mozilla/5.0 (Windows; rv:26.0) Gecko/20100101 Firefox/26.0
Build ID: 20150305021524

Steps to reproduce:

In Firefox 38.0.1, DataSourceSurfaceD2D1::Map uses uninitialized memory at gfx\2d\SourceSurfaceD2D1.cpp lines 186 and succeeding lines.

The problem is that DataSourceSurfaceD2D1::Map does not check the return value from the Windows function ID2D1Bitmap1::Map at line 185, thus (on failure) leaving untouched whatever was contained in the uninitialized variable map

177:  D2D1_MAP_OPTIONS options;
178:  if (aMapType == MapType::READ) {
179:    options = D2D1_MAP_OPTIONS_READ;
180:  } else {
181:    MOZ_CRASH("No support for Write maps on D2D1 DataSourceSurfaces yet!");
182:  }
183:
184:  D2D1_MAPPED_RECT map;
185:  mBitmap->Map(D2D1_MAP_OPTIONS_READ, &map);
186:  aMappedSurface->mData = map.bits;
187:  aMappedSurface->mStride = map.pitch;
188:
189:  mIsMapped = !!aMappedSurface->mData;
190:  return mIsMapped;

Since map can contain anything, this bug could make it possible to read from anywhere in Firefox's address space. This might potentially cause one session to read (and possibly use and/or display) data from a different session. Also, if someone adds support for write maps, this bug could allow data to be *written* to anywhere in Firefox's address space.

There also appears to be a similar bug in DataSourceSurfaceD2D1::EnsureMapped() at gfx\2d\SourceSurfaceD2D1.cpp line 218.

Comment 1

[Milan Sreckovic [:milan] (needinfo for best results)]

We've had Andrew look at similar issues (e.g., bug 1167393)

Comment 2

[Andrew Comminos [:acomminos]]

Attachment: Check mapping results in SourceSurfaceD2D1.

Comment 3

[Bas Schouten (:bas.schouten)]

Comment on attachment 8610769 [details] [diff] [review]
Check mapping results in SourceSurfaceD2D1.

Review of attachment 8610769 [details] [diff] [review]:
-----------------------------------------------------------------

Obviously no issues with this, did anyone check if Map does or doesn't null out the data pointer if it returns an error?

Comment 4

[Liz Henry (:lizzard) (relman/hg->git project)]

Does this need to land or is the fix still in progress?  Since this is sec-high I figure you may want to uplift it to beta once it's ready.

Comment 5

[Al Billings [:abillings - ex-MoCo]]

This needs sec-approval to land.

Comment 6

[Andrew Comminos [:acomminos]]

Fixes for DataSourceSurface::Map related bugs are handled in my patch for bug 1167356.

Comment 7

[Liz Henry (:lizzard) (relman/hg->git project)]

So, is this fixed ?  A dupe of 1167356? Or is there still work to do here for 39?

Comment 8

[Andrew Comminos [:acomminos]]

As per Daniel's suggestion, I've corrected all map related issues in 1167356.

Comment 10

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Since the original bug 1167356 is already fixed and uplifted in Beta, Aurora, moz-central etc., updating status-firefoxN to "fixed".