Bugzilla

Reporter

Comment 2

•

12 years ago

Just a fyi, some stack frames would be missing since it is an optimized build [if i had a repro, i would have used a fully symbolized build as in other bugs i usually file]. I think the use-after-free is happening in nsDocument::AdoptNode.

The raw oldDocument pointer [nsIDocument *oldDocument = adoptedNode->OwnerDoc();] is probably getting freed here
rv = nsNodeUtils::Adopt(adoptedNode, sameDocument ? nsnull : mNodeInfoManager,
6114                           cx, newScope, nodesWithProperties);

and later accessed here - 6122       for (PRUint32 j = 0; j < oldDocument->GetPropertyTableCount(); ++j) {

see PRUint32 GetPropertyTableCount()
953   { return mExtraPropertyTables.Length() + 1; } 
and we crash while accessing Length(). [#0 0x7fe983d5d952 in nsTArray_base<nsTArrayDefaultAllocator>::Length() const firefox/src/../../../dist/include/nsTArray.h:192]

This is just my cursory look, someone more familiar should take a closer look :)

Reporter

Updated

•

12 years ago

Summary: Heap-use-after-free in AdoptNodeIntoOwnerDoc → Heap-use-after-free in nsDocument::AdoptNode

Andrew McCreight [:mccr8]

Reporter

Updated

•

12 years ago

Whiteboard: [asan]

Mats Palmgren (inactive)

Updated

•

12 years ago

Severity: normal → critical

Keywords: crash

Comment 3

•

12 years ago

speculatively marking this sec-critical

Keywords: sec-critical

Andrew McCreight [:mccr8]

Updated

•

12 years ago

Keywords: testcase-wanted

Comment 4

•

12 years ago

Olli, could you please take a look at this?  It looks like there's a raw pointer to an OwnerDoc(), and maybe the underlying doc is going away.  You last touched that line, though it was just a rename. ;)

Assignee: nobody → bugs

Reporter

Comment 5

•

12 years ago

Attached file Testcase — Details

Reproducible testcase and fully symbolized stack::


=================================================================
==19471== ERROR: AddressSanitizer heap-use-after-free on address 0x7f0f7a9c8190 at pc 0x7f0fa5c9d952 bp 0x7fff2c0c9130 sp 0x7fff2c0c9128
READ of size 8 at 0x7f0f7a9c8190 thread T0
    #0 0x7f0fa5c9d952 in nsTArray_base<nsTArrayDefaultAllocator>::Length() const ../../../dist/include/nsTArray.h:192
    #1 0x7f0fa8c9dddd in nsIDocument::GetPropertyTableCount() ../../../dist/include/nsIDocument.h:953
    #2 0x7f0fa8d054fa in nsDocument::AdoptNode(nsIDOMNode*, nsIDOMNode**) content/base/src/nsDocument.cpp:6126
    #3 0x7f0fa8d0aff7 in non-virtual thunk to nsDocument::AdoptNode(nsIDOMNode*, nsIDOMNode**) modules/zlib/src/inffast.c:0
    #4 0x7f0fa8f89f5f in AdoptNodeIntoOwnerDoc(nsINode*, nsINode*) content/base/src/nsINode.cpp:1256
    #5 0x7f0fa8f8e612 in nsINode::ReplaceOrInsertBefore(bool, nsINode*, nsINode*) content/base/src/nsINode.cpp:1808
    #6 0x7f0fa8f73b2e in nsINode::ReplaceOrInsertBefore(bool, nsIDOMNode*, nsIDOMNode*, nsIDOMNode**) content/base/src/nsINode.cpp:470
    #7 0x7f0fa8e22169 in nsGenericElement::InsertBefore(nsIDOMNode*, nsIDOMNode*, nsIDOMNode**) ../../../../dist/include/nsGenericElement.h:392
    #8 0x7f0fa9e7a3f4 in nsHTMLBodyElement::InsertBefore(nsIDOMNode*, nsIDOMNode*, nsIDOMNode**) content/html/content/src/nsHTMLBodyElement.cpp:68
    #9 0x7f0fa9e7ec6f in non-virtual thunk to nsHTMLBodyElement::InsertBefore(nsIDOMNode*, nsIDOMNode*, nsIDOMNode**) modules/zlib/src/inffast.c:0
    #10 0x7f0fabddc9b6 in DeleteElementTxn::UndoTransaction() editor/libeditor/base/DeleteElementTxn.cpp:159
    #11 0x7f0faf02ceeb in nsTransactionItem::UndoTransaction(nsTransactionManager*) editor/txmgr/src/nsTransactionItem.cpp:198
    #12 0x7f0faf0404ec in nsTransactionManager::UndoTransaction() editor/txmgr/src/nsTransactionManager.cpp:134
    #13 0x7f0fabcb2882 in nsEditor::Undo(unsigned int) editor/libeditor/base/nsEditor.cpp:802
    #14 0x7f0fabc512c6 in nsPlaintextEditor::Undo(unsigned int) editor/libeditor/text/nsPlaintextEditor.cpp:1082
    #15 0x7f0fabd5156c in nsUndoCommand::DoCommand(char const*, nsISupports*) editor/libeditor/base/nsEditorCommands.cpp:57
    #16 0x7f0faeec79bd in nsControllerCommandTable::DoCommand(char const*, nsISupports*) embedding/components/commandhandler/src/nsControllerCommandTable.cpp:158
    #17 0x7f0faee9a2c4 in nsBaseCommandController::DoCommand(char const*) embedding/components/commandhandler/src/nsBaseCommandController.cpp:137
    #18 0x7f0faeeb2701 in nsCommandManager::DoCommand(char const*, nsICommandParams*, nsIDOMWindow*) embedding/components/commandhandler/src/nsCommandManager.cpp:239
    #19 0x7f0faa64073e in nsHTMLDocument::ExecCommand(nsAString_internal const&, bool, nsAString_internal const&, bool*) content/html/document/src/nsHTMLDocument.cpp:3193
    #20 0x7f0faa642fae in non-virtual thunk to nsHTMLDocument::ExecCommand(nsAString_internal const&, bool, nsAString_internal const&, bool*) modules/zlib/src/inffast.c:0
    #21 0x7f0fb222755a in NS_InvokeByIndex_P xpcom/reflect/xptcall/src/md/unix/xptcinvoke_x86_64_unix.cpp:161
    #22 0x7f0fadb9521b in CallMethodHelper::Call() js/xpconnect/src/XPCWrappedNative.cpp:2405
    #23 0x7f0fadbfc5f4 in XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1474
    #24 0x7f0fb754b53d in js::CallJSNative(JSContext*, int (*)(JSContext*, unsigned int, JS::Value*), js::CallArgs const&) js/src/jscntxtinlines.h:400
    #25 0x7f0fb74bf71d in js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) js/src/jsinterp.cpp:2437
    #26 0x7f0fb7444ef7 in js::RunScript(JSContext*, JSScript*, js::StackFrame*) js/src/jsinterp.cpp:267
    #27 0x7f0fb755834d in js::ExecuteKernel(JSContext*, JSScript*, JSObject&, JS::Value const&, js::ExecuteType, js::StackFrame*, JS::Value*) js/src/jsinterp.cpp:455
    #28 0x7f0fb755a050 in js::Execute(JSContext*, JSScript*, JSObject&, JS::Value*) js/src/jsinterp.cpp:492
    #29 0x7f0fb6d89ba6 in EvaluateUCScriptForPrincipalsCommon(JSContext*, JSObject*, JSPrincipals*, JSPrincipals*, unsigned short const*, unsigned int, char const*, unsigned int, JS::Value*, JSVersion) js/src/jsapi.cpp:5371
    #30 0x7f0fb6d8bacc in JS_EvaluateUCScriptForPrincipalsVersionOrigin js/src/jsapi.cpp:5408
    #31 0x7f0faadedcba in nsJSContext::EvaluateString(nsAString_internal const&, JSObject*, nsIPrincipal*, nsIPrincipal*, char const*, unsigned int, JSVersion, nsAString_internal*, bool*) dom/base/nsJSEnvironment.cpp:1463
    #32 0x7f0faaf9012e in nsGlobalWindow::RunTimeoutHandler(nsTimeout*, nsIScriptContext*) dom/base/nsGlobalWindow.cpp:9057
    #33 0x7f0faaf50212 in nsGlobalWindow::RunTimeout(nsTimeout*) dom/base/nsGlobalWindow.cpp:9321
    #34 0x7f0faaf8e33b in nsGlobalWindow::TimerCallback(nsITimer*, void*) dom/base/nsGlobalWindow.cpp:9593
    #35 0x7f0fb2163fc2 in nsTimerImpl::Fire() xpcom/threads/nsTimerImpl.cpp:474
    #36 0x7f0fb2165bfc in nsTimerEvent::Run() xpcom/threads/nsTimerImpl.cpp:558
    #37 0x7f0fb21282b3 in nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:625
    #38 0x7f0fb1db855d in NS_ProcessNextEvent_P(nsIThread*, bool) objdir-ff-asan-sym/xpcom/build/nsThreadUtils.cpp:217
    #39 0x7f0fb0f15ff6 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:82
    #40 0x7f0fb23da88a in MessageLoop::RunInternal() ipc/chromium/src/base/message_loop.cc:209
    #41 0x7f0fb23da6d3 in MessageLoop::RunHandler() ipc/chromium/src/base/message_loop.cc:202
    #42 0x7f0fb23da5b8 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:176
    #43 0x7f0fb045391e in nsBaseAppShell::Run() widget/xpwidgets/nsBaseAppShell.cpp:165
    #44 0x7f0faf09d518 in nsAppStartup::Run() toolkit/components/startup/nsAppStartup.cpp:256
    #45 0x7f0fa5a8f6d7 in XREMain::XRE_mainRun() toolkit/xre/nsAppRunner.cpp:3786
    #46 0x7f0fa5a96092 in XREMain::XRE_main(int, char**, nsXREAppData const*) toolkit/xre/nsAppRunner.cpp:3863
    #47 0x7f0fa5a9954b in XRE_main toolkit/xre/nsAppRunner.cpp:3939
    #48 0x40a91f in do_main(int, char**) browser/app/nsBrowserApp.cpp:160
    #49 0x40834d in main browser/app/nsBrowserApp.cpp:330
    #50 0x7f0fc02dbc4d in ?? ??:0
0x7f0f7a9c8190 is located 272 bytes inside of 1376-byte region [0x7f0f7a9c8080,0x7f0f7a9c85e0)
freed by thread T0 here:
    #0 0x4a2ed2 in free ??:0
    #1 0x7f0fbd1695c3 in moz_free memory/mozalloc/mozalloc.cpp:49
    #2 0x7f0fa8c891c2 in nsIDocument::operator delete(void*) ../../../../dist/include/nsIDocument.h:125
    #3 0x7f0faa6f8d18 in ~nsXMLDocument content/xml/document/src/nsXMLDocument.cpp:226
    #4 0x7f0fa9022b5d in nsNodeUtils::LastRelease(nsINode*) content/base/src/nsNodeUtils.cpp:252
    #5 0x7f0fa8c97fdf in nsDocument::Release() content/base/src/nsDocument.cpp:1678
    #6 0x7f0faa6fa814 in nsXMLDocument::Release() content/xml/document/src/nsXMLDocument.cpp:241
    #7 0x7f0fa901192f in nsNodeInfoManager::RemoveNodeInfo(nsNodeInfo*) content/base/src/nsNodeInfoManager.cpp:387
    #8 0x7f0fa90021ff in ~nsNodeInfo content/base/src/nsNodeInfo.cpp:74
    #9 0x7f0fa900559d in nsNodeInfo::LastRelease() content/base/src/nsNodeInfo.cpp:236
    #10 0x7f0fa900519c in nsNodeInfo::Release() content/base/src/nsNodeInfo.cpp:185
    #11 0x7f0fb1d6ee10 in ~nsCOMPtr_base objdir-ff-asan-sym/xpcom/build/nsCOMPtr.cpp:48
    #12 0x7f0fa6f61706 in ~nsCOMPtr ../../../dist/include/nsCOMPtr.h:442
    #13 0x7f0fa6f615f3 in ~nsCOMPtr ../../../dist/include/nsCOMPtr.h:442
    #14 0x7f0fa902a7ee in nsNodeUtils::CloneAndAdopt(nsINode*, bool, bool, nsNodeInfoManager*, JSContext*, JSObject*, nsCOMArray<nsINode>&, nsINode*, nsINode**) content/base/src/nsNodeUtils.cpp:597
    #15 0x7f0fa8dcdfaa in nsNodeUtils::CloneAndAdopt(nsINode*, bool, bool, nsNodeInfoManager*, JSContext*, JSObject*, nsCOMArray<nsINode>&, nsIDOMNode**) ../../../../dist/include/nsNodeUtils.h:272
    #16 0x7f0fa8d09fb9 in nsNodeUtils::Adopt(nsINode*, nsNodeInfoManager*, JSContext*, JSObject*, nsCOMArray<nsINode>&) content/base/src/nsNodeUtils.h:172
    #17 0x7f0fa8d04e91 in nsDocument::AdoptNode(nsIDOMNode*, nsIDOMNode**) content/base/src/nsDocument.cpp:6103
    #18 0x7f0fa8d0aff7 in non-virtual thunk to nsDocument::AdoptNode(nsIDOMNode*, nsIDOMNode**) modules/zlib/src/inffast.c:0
    #19 0x7f0fa8f89f5f in AdoptNodeIntoOwnerDoc(nsINode*, nsINode*) content/base/src/nsINode.cpp:1256
    #20 0x7f0fa8f8e612 in nsINode::ReplaceOrInsertBefore(bool, nsINode*, nsINode*) content/base/src/nsINode.cpp:1808
    #21 0x7f0fa8f73b2e in nsINode::ReplaceOrInsertBefore(bool, nsIDOMNode*, nsIDOMNode*, nsIDOMNode**) content/base/src/nsINode.cpp:470
    #22 0x7f0fa8e22169 in nsGenericElement::InsertBefore(nsIDOMNode*, nsIDOMNode*, nsIDOMNode**) ../../../../dist/include/nsGenericElement.h:392
    #23 0x7f0fa9e7a3f4 in nsHTMLBodyElement::InsertBefore(nsIDOMNode*, nsIDOMNode*, nsIDOMNode**) content/html/content/src/nsHTMLBodyElement.cpp:68
    #24 0x7f0fa9e7ec6f in non-virtual thunk to nsHTMLBodyElement::InsertBefore(nsIDOMNode*, nsIDOMNode*, nsIDOMNode**) modules/zlib/src/inffast.c:0
    #25 0x7f0fabddc9b6 in DeleteElementTxn::UndoTransaction() editor/libeditor/base/DeleteElementTxn.cpp:159
    #26 0x7f0faf02ceeb in nsTransactionItem::UndoTransaction(nsTransactionManager*) editor/txmgr/src/nsTransactionItem.cpp:198
    #27 0x7f0faf0404ec in nsTransactionManager::UndoTransaction() editor/txmgr/src/nsTransactionManager.cpp:134
    #28 0x7f0fabcb2882 in nsEditor::Undo(unsigned int) editor/libeditor/base/nsEditor.cpp:802
    #29 0x7f0fabc512c6 in nsPlaintextEditor::Undo(unsigned int) editor/libeditor/text/nsPlaintextEditor.cpp:1082
previously allocated by thread T0 here:
    #0 0x4a2f92 in malloc ??:0
    #1 0x7f0fbd169717 in moz_xmalloc memory/mozalloc/mozalloc.cpp:54
    #2 0x7f0faa5fa30a in nsIDocument::operator new(unsigned long) ../../../../dist/include/nsIDocument.h:125
    #3 0x7f0faa6f70e7 in NS_NewXMLDocument(nsIDocument**) content/xml/document/src/nsXMLDocument.cpp:174
    #4 0x7f0faa6f4186 in NS_NewDOMDocument(nsIDOMDocument**, nsAString_internal const&, nsAString_internal const&, nsIDOMDocumentType*, nsIURI*, nsIURI*, nsIPrincipal*, bool, nsIScriptGlobalObject*, DocumentFlavor) content/xml/document/src/nsXMLDocument.cpp:120
    #5 0x7f0fa8ae543b in nsContentUtils::CreateDocument(nsAString_internal const&, nsAString_internal const&, nsIDOMDocumentType*, nsIURI*, nsIURI*, nsIPrincipal*, nsIScriptGlobalObject*, DocumentFlavor, nsIDOMDocument**) content/base/src/nsContentUtils.cpp:4228
    #6 0x7f0fa8c80937 in nsDOMImplementation::CreateDocument(nsAString_internal const&, nsAString_internal const&, nsIDOMDocumentType*, nsIDOMDocument**) content/base/src/nsDocument.cpp:1400
    #7 0x7f0fadd4c7d1 in nsIDOMDOMImplementation_CreateDocument(JSContext*, unsigned int, JS::Value*) objdir-ff-asan-sym/js/xpconnect/src/dom_quickstubs.cpp:6262
    #8 0x7f0fb754b53d in js::CallJSNative(JSContext*, int (*)(JSContext*, unsigned int, JS::Value*), js::CallArgs const&) js/src/jscntxtinlines.h:400
    #9 0x7f0fb74bf71d in js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) js/src/jsinterp.cpp:2437
    #10 0x7f0fb7444ef7 in js::RunScript(JSContext*, JSScript*, js::StackFrame*) js/src/jsinterp.cpp:267
    #11 0x7f0fb755834d in js::ExecuteKernel(JSContext*, JSScript*, JSObject&, JS::Value const&, js::ExecuteType, js::StackFrame*, JS::Value*) js/src/jsinterp.cpp:455
    #12 0x7f0fb755a050 in js::Execute(JSContext*, JSScript*, JSObject&, JS::Value*) js/src/jsinterp.cpp:492
    #13 0x7f0fb6d89ba6 in EvaluateUCScriptForPrincipalsCommon(JSContext*, JSObject*, JSPrincipals*, JSPrincipals*, unsigned short const*, unsigned int, char const*, unsigned int, JS::Value*, JSVersion) js/src/jsapi.cpp:5371
    #14 0x7f0fb6d8bacc in JS_EvaluateUCScriptForPrincipalsVersionOrigin js/src/jsapi.cpp:5408
    #15 0x7f0faadedcba in nsJSContext::EvaluateString(nsAString_internal const&, JSObject*, nsIPrincipal*, nsIPrincipal*, char const*, unsigned int, JSVersion, nsAString_internal*, bool*) dom/base/nsJSEnvironment.cpp:1463
    #16 0x7f0faaf9012e in nsGlobalWindow::RunTimeoutHandler(nsTimeout*, nsIScriptContext*) dom/base/nsGlobalWindow.cpp:9057
    #17 0x7f0faaf50212 in nsGlobalWindow::RunTimeout(nsTimeout*) dom/base/nsGlobalWindow.cpp:9321
    #18 0x7f0faaf8e33b in nsGlobalWindow::TimerCallback(nsITimer*, void*) dom/base/nsGlobalWindow.cpp:9593
    #19 0x7f0fb2163fc2 in nsTimerImpl::Fire() xpcom/threads/nsTimerImpl.cpp:474
    #20 0x7f0fb2165bfc in nsTimerEvent::Run() xpcom/threads/nsTimerImpl.cpp:558
    #21 0x7f0fb21282b3 in nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:625
    #22 0x7f0fb1db855d in NS_ProcessNextEvent_P(nsIThread*, bool) objdir-ff-asan-sym/xpcom/build/nsThreadUtils.cpp:217
==19471== ABORTING
Stats: 161M malloced (195M for red zones) by 477865 calls
Stats: 42M realloced by 21082 calls
Stats: 133M freed by 253158 calls
Stats: 4M really freed by 26640 calls
Stats: 384M (98355 full pages) mmaped in 96 calls
  mmaps   by size class: 8:393192; 9:57337; 10:20475; 11:18423; 12:3072; 13:2560; 14:1536; 15:384; 16:576; 17:128; 18:176; 19:48; 20:16;
  mallocs by size class: 8:386642; 9:48905; 10:17303; 11:17596; 12:2614; 13:2059; 14:1468; 15:368; 16:564; 17:120; 18:172; 19:41; 20:13;
  frees   by size class: 8:179728; 9:38690; 10:14192; 11:14505; 12:1788; 13:1848; 14:1286; 15:315; 16:494; 17:105; 18:159; 19:38; 20:10;
  rfrees  by size class: 8:24250; 9:1147; 10:583; 11:312; 12:57; 13:183; 14:90; 15:9; 16:6; 17:3;
Stats: malloc large: 346 small slow: 2155
Shadow byte and word:
  0x1fe1ef539032: fd
  0x1fe1ef539030: fd fd fd fd fd fd fd fd
More shadow bytes:
  0x1fe1ef539010: fd fd fd fd fd fd fd fd
  0x1fe1ef539018: fd fd fd fd fd fd fd fd
  0x1fe1ef539020: fd fd fd fd fd fd fd fd
  0x1fe1ef539028: fd fd fd fd fd fd fd fd
=>0x1fe1ef539030: fd fd fd fd fd fd fd fd
  0x1fe1ef539038: fd fd fd fd fd fd fd fd
  0x1fe1ef539040: fd fd fd fd fd fd fd fd
  0x1fe1ef539048: fd fd fd fd fd fd fd fd
  0x1fe1ef539050: fd fd fd fd fd fd fd fd

Assignee

Comment 6

•

12 years ago

(In reply to Abhishek Arya from comment #5)
> Created attachment 636186 [details]
> Testcase
> 
> Reproducible testcase and fully symbolized stack::


Doesn't work here :(

Reporter

Comment 7

•

12 years ago

(In reply to Olli Pettay [:smaug] from comment #6)
> (In reply to Abhishek Arya from comment #5)
> > Created attachment 636186 [details]
> > Testcase
> > 
> > Reproducible testcase and fully symbolized stack::
> 
> 
> Doesn't work here :(

Did you try with an ASANified release build from https://people.mozilla.com/~choller/firefox/asan/ ? It reproduces for me on multiple machines. Also, the new symbolized stack seems to match my analysis in c#2.

Assignee

Comment 8

•

12 years ago

No. Never heard of ASANified builds before :)
Anyhow, I'll post a patch soon.

Reporter

Comment 9

•

12 years ago

(In reply to Olli Pettay [:smaug] from comment #8)
> No. Never heard of ASANified builds before :)

Some context :)

http://blog.chromium.org/2012/04/fuzzing-for-security.html
http://blog.chromium.org/2011/06/testing-chromium-addresssanitizer-fast.html
http://blog.mozilla.org/decoder/2012/01/27/trying-new-code-analysis-techniques/

> Anyhow, I'll post a patch soon.

Assignee

Comment 10

•

12 years ago

Attached patch possible patch — Details — Splinter Review

Based on the comments here, and looking at the code, this might work.
But since I can't reproduce, can't be sure.
Could anyone, who can reproduce the problem, try this.

Assignee

Comment 11

•

12 years ago

Ok, I can see the crash using Nightly ASAN build. Unfortunately it doesn't crash when
run in gdb.

Assignee

Comment 12

•

12 years ago

And looks like I managed to reproduce the crash only once.

Assignee

Updated

•

12 years ago

Attachment #636260 - Flags: review?(peterv)

Andrew McCreight [:mccr8]

Reporter

Comment 13

•

12 years ago

(In reply to Olli Pettay [:smaug] from comment #10)
> Created attachment 636260 [details] [diff] [review]
> possible patch
> 
> Based on the comments here, and looking at the code, this might work.
> But since I can't reproduce, can't be sure.
> Could anyone, who can reproduce the problem, try this.

Yes, your patch fixes the UAF crash.

Comment 14

•

12 years ago

Do you know what versions this affects?

Peter Van der Beken [:peterv]

Comment 15

•

12 years ago

Comment on attachment 636260 [details] [diff] [review]
possible patch

Review of attachment 636260 [details] [diff] [review]:
-----------------------------------------------------------------

So I guess what happens is that we adopt into an empty document and then adopt into another document, so the first document becomes empty again and it's destroyed during the second adopt? It's a bit scary to fix this without really understanding what happens :-(.

Attachment #636260 - Flags: review?(peterv) → review+

Assignee

Comment 16

•

12 years ago

Comment on attachment 636260 [details] [diff] [review]
possible patch

[Approval Request Comment]
Regression caused by (bug #): NA
User impact if declined: crash
Testing completed (on m-c, etc.): Hasn't landed yet 
Risk to taking this patch (and alternatives if risky): Should be super safe

Attachment #636260 - Flags: approval-mozilla-release?

Attachment #636260 - Flags: approval-mozilla-esr10?

Attachment #636260 - Flags: approval-mozilla-beta?

Comment 17

•

12 years ago

Comment on attachment 636260 [details] [diff] [review]
possible patch

a=dveditz for all the branches. The problem is pretty obvious from the patch, and if it's popping out of fuzzing often then it's got a reasonable chance of being rediscovered in the next 6 weeks.

Attachment #636260 - Flags: approval-mozilla-release?

Attachment #636260 - Flags: approval-mozilla-release+

Attachment #636260 - Flags: approval-mozilla-esr10?

Attachment #636260 - Flags: approval-mozilla-esr10+

Attachment #636260 - Flags: approval-mozilla-beta?

Attachment #636260 - Flags: approval-mozilla-beta+

Assignee

Comment 18

•

12 years ago

https://hg.mozilla.org/mozilla-central/rev/5b77d71ed927

Status: NEW → RESOLVED

Closed: 12 years ago

Resolution: --- → FIXED

Assignee

Comment 19

•

12 years ago

https://hg.mozilla.org/releases/mozilla-beta/rev/f8cd8c7c1be7
https://hg.mozilla.org/releases/mozilla-aurora/rev/dd68ba7da9a6

status-firefox-esr10: --- → affected

status-firefox14: --- → fixed

status-firefox15: --- → fixed

status-firefox16: --- → fixed

Comment 20

•

12 years ago

https://hg.mozilla.org/releases/mozilla-esr10/rev/9b64746415c2

status-firefox-esr10: affected → fixed

tracking-firefox-esr10: --- → 14+

Updated

•

12 years ago

Whiteboard: [asan] → [asan][advisory-tracking+]

u279076

Comment 21

•

12 years ago

I'm unable to reproduce this crash using the attached testcase and an ASAN debug Nightly based off mozilla-central 2012-07-08. Unless a more reproducible testcase can be provided, I'm not sure QA will be able to verify this bug is fixed. Can anyone provide any insight or assistance in verify this fix?

Whiteboard: [asan][advisory-tracking+] → [asan][advisory-tracking+][qa?]

Reporter

Comment 22

•

12 years ago

I remember testing this fix (c#13) and the testcase was 100% reproducible for me.

u279076

Comment 23

•

12 years ago

(In reply to Abhishek Arya from comment #22)
> I remember testing this fix (c#13) and the testcase was 100% reproducible
> for me.

It's 0% reproducible for me. Would you mind verifying if this is fixed with a latest Nightly build?

Updated

•

12 years ago

Alias: CVE-2012-1954

Reporter

Comment 24

•

12 years ago

(In reply to Anthony Hughes, Mozilla QA (irc: ashughes) from comment #23)
> (In reply to Abhishek Arya from comment #22)
> > I remember testing this fix (c#13) and the testcase was 100% reproducible
> > for me.
> 
> It's 0% reproducible for me. Would you mind verifying if this is fixed with
> a latest Nightly build?

Verified.
Crashes on 46362775ce79 (opt), built on 20120630
Does not crash on d070bd19c526 (opt), built on 20120711

Used builds from https://people.mozilla.com/~choller/firefox/asan/

u279076

Comment 25

•

12 years ago

Thanks! Marking this verified against Nightly. We won't be able to verify this against Beta/Release/ESR due to technical constraints.

Status: RESOLVED → VERIFIED

status-firefox16: fixed → verified

Whiteboard: [asan][advisory-tracking+][qa?] → [asan][advisory-tracking+][qa-]

Updated

•

12 years ago

Group: core-security

Updated

•

11 years ago

Flags: sec-bounty?

Updated

•

11 years ago

Flags: sec-bounty? → sec-bounty+

Ryan VanderMeulen [:RyanVM]

Comment 26

•

11 years ago

Attached file inferno@chromium.org,3000,2012-06-14,2013-03-11,2012-07-10,true — Details

Updated

•

9 years ago

Keywords: testcase-wanted