1299062 - heap-overflow and potential UAF [@mozilla::dom::CanvasRenderingContext2D::GetImageDataArray]

Status: RESOLVED FIXED

(Core :: Graphics: Canvas2D, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: uaf_log.txt

I have seen this reproduce as both an out of bounds read and a use-after-free.

==8460==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000339c18 at pc 0x7ffac8affce2 bp 0x7ffcf33eaeb0 sp 0x7ffcf33eaea8
READ of size 1 at 0x602000339c18 thread T0
    #0 0x7ffac8affce1 in mozilla::dom::CanvasRenderingContext2D::GetImageDataArray(JSContext*, int, int, unsigned int, unsigned int, JSObject**) /home/worker/workspace/build/src/dom/canvas/CanvasRenderingContext2D.cpp:5491:19
    #1 0x7ffac8afe14f in mozilla::dom::CanvasRenderingContext2D::GetImageData(JSContext*, double, double, double, double, mozilla::ErrorResult&) /home/worker/workspace/build/src/dom/canvas/CanvasRenderingContext2D.cpp:5368:12
    #2 0x7ffac7c4c216 in mozilla::dom::CanvasRenderingContext2DBinding::getImageData(JSContext*, JS::Handle<JSObject*>, mozilla::dom::CanvasRenderingContext2D*, JSJitMethodCallArgs const&) /home/worker/workspace/build/src/obj-firefox/dom/bindings/CanvasRenderingContext2DBinding.cpp:4584:55
    #3 0x7ffac8a078c0 in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) /home/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:2812:13
    #4 0x7ffaceace6bc in CallJSNative /home/worker/workspace/build/src/js/src/jscntxtinlines.h:235:15

Comment 1

[Tyson Smith [:tsmith]]

Attachment: overflow_log.txt

Comment 2

[Tyson Smith [:tsmith]]

Attachment: test_case.html

Comment 3

[Ethan Lin[:ethlin]]

Attachment: Check if drawtarget valid

Before using the DrawTarget, we should check if it's valid.

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1065b1b168df

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/1065b1b168df

This probably should have gone through the sec-approval process before landing. What rating should it have? What branches are affected?

Comment 6

[Ethan Lin[:ethlin]]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #5)
> https://hg.mozilla.org/mozilla-central/rev/1065b1b168df
> 
> This probably should have gone through the sec-approval process before
> landing. What rating should it have? What branches are affected?

Only firefox51 is affected. The bug has a csectype-uaf rating.

Comment 7

[Ethan Lin[:ethlin]]

Attachment: crashtest

Add the testcase into crashtest.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c4fb41365df3

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/c4fb41365df3