756792 - Heap-buffer-overflow due to IcedTea plugin

Status: RESOLVED INVALID

(Core Graveyard :: Plug-ins, defect)

Description

[Arthur Gerkis]

Attachment: test-case (.zip) triggering the crash

ASan reported heap-buffer-overflow after triggering event attached to applet loaded with IcedTea plugin.
 
Environment information:
java version "1.6.0_23"
OpenJDK Runtime Environment (IcedTea6 1.11pre) (6b23~pre11-0ubuntu1.11.10.2)
OpenJDK 64-Bit Server VM (build 20.0-b11, mixed mode)

Tested only on Linux x64, 14 and 15 branch.

Comment 1

[Arthur Gerkis]

Attachment: ASan log (symbolized)

Comment 2

[Arthur Gerkis]

Attachment: ASan log (non-symbolized, just to see the paths)

Comment 3

[Benjamin Smedberg]

Why don't we have symbols for the plugin? Isn't it an open-source plugin?

What file format is the testcase?

Comment 4

[Arthur Gerkis]

(In reply to Benjamin Smedberg  [:bsmedberg] from comment #3)
> 
> What file format is the testcase?

Not sure what do you mean - isn't test-case working for you? There should be two files in zip archive - run.html and TestApplet.class, one have to open run.html.

Comment 5

[Benjamin Smedberg]

Comment on attachment 625421 [details]
test-case (.zip) triggering the crash

Bugzilla doesn't show file names, so I had no way of knowing that it was a zip

Comment 6

[Daniel Veditz [:dveditz]]

Could be an off-by-one in IcedTea itself... who maintains that?

Comment 7

[David Bolter [:davidb] (NeedInfo me for attention)]

Jorge, do you know who maintains IcedTea?

Comment 8

[Jorge Villalobos [:jorgev] (he/him)]

According to bug 739955 comment #65, it is Deepak Bhole ([e-mail]).

Comment 9

[Al Billings [:abillings - ex-MoCo]]

Adding Deepak since no one else did.

Comment 10

[Deepak Bhole]

Attachment: Patch to fix this issue

Thank you for adding me to cc: Al. I have investigated the issue and found the underlying cause. Since the reproducer is already posted here, I see no reason not to post the proposed fix as well. With attached patch, the heap overflow is curtailed and ASAN shows no errors.

I will talk to our security team to do a proper release as appropriate and will post the details here once I have them.

Comment 11

[Deepak Bhole]

Attachment: Final fix for this issue

Hi. I am attaching the latest (and final) proposed fix for this issue. Tomas Hoger from our security team found a couple of other potential problem areas and while investigating, we also found some memory leaks. This patch addresses all issues.

We have assigned a CVE for this (CVE-2012-4540) and the unembargo date is tentatively set for November 7th 2012.

Comment 12

[Al Billings [:abillings - ex-MoCo]]

Do we need to check this in somewhere?

Comment 13

[Benjamin Smedberg]

No, this is a bug/fix in the icetea java plugin and is not a bug in any Mozilla product. Marking INVALID for now, and we can clear the security flag once the embargo is lifted.

Comment 14

[Deepak Bhole]

(In reply to Benjamin Smedberg  [:bsmedberg] from comment #13)
> No, this is a bug/fix in the icetea java plugin and is not a bug in any
> Mozilla product. Marking INVALID for now, and we can clear the security flag
> once the embargo is lifted.

Thanks. 

I posted the patch here just as an FYI. Mozilla product code is not affected in any way.

Comment 15

[Tomas Hoger]

Fixed in IcedTea-Web 1.1.7, 1.2.2 and 1.3.1:

http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-November/020775.html

Comment 16

[Jesse Ruderman]

Is it ok to make this bug report public now?

Comment 17

[Deepak Bhole]

Yes, the fix has been publicly released for a while now and there is no harm in opening this bug.