1002748 - crash in libinject.dll@0x1e1dd

Status: VERIFIED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Tracy Walker [:tracy]]

This bug was filed from the Socorro interface and is 
report bp-e8367921-ee71-43b9-a2b6-979de2140422.
=============================================================

This is appearing on all current branches as it is caused by an adware extension from Wajamu: Found this from the extension ID in FX (21EAF666-26B3-4a3c-ABD0-CA2F5A326744): http://www.herdprotect.com/extension32.dll-8c1de0fc73f99e5334b7583981bb5fe77b276efd.aspx

Comment 1

[(Away)]

This unversioned module is from V-bates. All the reports I looked at have the DLL from Apr 08.

V-Bates has been blocked before in bug 964594. The ID {21EAF666-26B3-4a3c-ABD0-CA2F5A326744} was mentioned there but couldn't be confirmed at that time.

    Image path: C:\Program Files\V-bates\libinject.dll
    Image name: libinject.dll
    Timestamp:        Tue Apr 08 00:34:37 2014 (53429B5D)
    CheckSum:         0009661B
    ImageSize:        0008D000
    File version:     0.0.0.0
    Product version:  0.0.0.0

Comment 2

[Robert Kaiser]

If the add-on ID ius the same for all cases, we can ship an add-on block with online blocklist refresh, but if we need to block the DLL, we need to do that with a patch.

Comment 3

[Tracy Walker [:tracy]]

This is now #1 on the Fx30 topcrash list.

Comment 4

[Benjamin Smedberg]

dmajor, please block the DLL.

Comment 5

[(Away)]

Attachment: Blocklist libinject.dll

Comment 6

[(Away)]

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/8370ec67828e

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/8370ec67828e

Comment 8

[Tracy Walker [:tracy]]

I'm not seeing any occurrences of this crash on m-c (Fx32) since this landed. 

dmajor, please request uplift to aurora and beta.

Comment 9

[Robert Kaiser]

(In reply to [:tracy] Tracy Walker - QA Mentor from comment #8)
> dmajor, please request uplift to aurora and beta.

Setting ni? for this.

Comment 10

[(Away)]

Comment on attachment 8417795 [details] [diff] [review]
Blocklist libinject.dll

[Approval Request Comment]
Bug caused by (feature/regressing bug #): External software
User impact if declined: #1 crash on beta (13%)
Testing completed (on m-c, etc.): verified fixed on m-c
Risk to taking this patch (and alternatives if risky): low
String or IDL/UUID changes made by this patch: none

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/da52e2edf7ae
https://hg.mozilla.org/releases/mozilla-beta/rev/b334e79cf04f

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g30_v1_4/rev/b334e79cf04f

Comment 13

[Tracy Walker [:tracy]]

We're no longer seeing crash reports against with builds of aurora(Fx31) and beta(Fx30), since this landed on each.

Comment 14

[Tracy Walker [:tracy]]

crashes for the last 28 days on betas:

on builds prior to blocklisting:
30beta3 - 9836
30beta4 - 5368 

on builds after the blocklist landed:
30beta5 - 42
30beta6 - 2
30beta7 - 16
30beta8 - 41
30beta9 - 535
30 RC   - 307

It looks like the blocklist was working for the most part on betas 5-8, Then crash numbers with our last two 30 builds have increased. Why would the blocklisting stop working?

Comment 15

[(Away)]

Tracy, thanks for pointing that out. I noticed that all the libinject crashes also had SPVC32.dll loaded. The latest SearchProtect is disabling the blocklist in order to get through. I've opened bug 1022471.

Comment 16

[Robert Kaiser]

For some more fun, there's a libinject2.dll now! https://crash-stats.mozilla.com/report/list?signature=libinject2.dll%400x16aff

Comment 17

[(Away)]

Lovely.

    Image path: C:\Program Files\V-bates\libinject2.dll
    Timestamp:        Thu May 22 23:16:35 2014 (537DDC93)