Closed Bug 1031973 Opened 12 years ago Closed 12 years ago

Heap buffer overflow in Gamepad::SetAxis()

Categories

(Core :: Hardware Abstraction Layer (HAL), defect)

Product:
Core
Component:
Hardware Abstraction Layer (HAL)
Version:
30 Branch
Platform:
x86_64
Windows 7
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
firefox31 --- wontfix
firefox32 --- unaffected
firefox33 --- unaffected

People

(Reporter: loobenyang, Assigned: ted)

Details

(Keywords: csectype-bounds, reporter-external, sec-high, Whiteboard: [reporter-external])

Attachments

(3 files)

Bof_SetAxis_Repro.html
186 bytes, text/html
Details
Bof_SetAxis_31offical_minidump.dmp
150.78 KB, application/octet-stream
Details
Bof_SetAxis_31offical_win8_minidump.dmp
153.95 KB, application/octet-stream
Details
Attached file Bof_SetAxis_Repro.html —
User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.97 Safari/537.36 Steps to reproduce: Run the reproduction test case in Firefox. Reproduction case: <script> gc = window.gc || function() { for (var i = 0; i < 0x1000000; ++i) var s = new String('AAAA'); }; gc();gc(); navigator.getGamepads(); gc();gc(); </script> Firefox version: 30 release; 31 beta; 31.0a1 (2014-05-22) Operating System: Windows 7 64 bit with virtual gamepad driver vJoy Actual results: The Firefox browser crashes with heap corruption caused by a buffer overflow in Gamepad::SetAxis(). Expected results: Firefox should not crash or have any memory corruption.
It's kind of a variant of Bug 1011859 (https://bugzilla.mozilla.org/show_bug.cgi?id=1011859). Unfortunately the patch for Bug 1011859 is vulnerable to race condition. Run my local build of 31.0a1 (2014-05-22) with patch of Bug 1011859 applied and page heap enabled, the buffer overflow can be caught stably: First-chance exception at 0x5A4867F3 (xul.dll) in firefox.exe: 0xC0000005: Access violation reading location 0xA5415000. Unhandled exception at 0x5A4867F3 (xul.dll) in firefox.exe: 0xC0000005: Access violation reading location 0xA5415000. Stack Trace: > xul.dll!mozilla::dom::Gamepad::SetAxis(unsigned int aAxis, double aValue) Line 67 C++ xul.dll!mozilla::dom::GamepadService::NewAxisMoveEvent(unsigned int aIndex, unsigned int aAxis, double aValue) Line 271 C++ xul.dll!`anonymous namespace'::GamepadEvent::Run() Line 280 C++ xul.dll!nsThread::ProcessNextEvent(bool mayWait, bool * result) Line 715 C++ xul.dll!NS_ProcessNextEvent(nsIThread * thread, bool mayWait) Line 263 C++ xul.dll!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate * aDelegate) Line 95 C++ xul.dll!MessageLoop::RunHandler() Line 223 C++ xul.dll!MessageLoop::Run() Line 197 C++ xul.dll!nsBaseAppShell::Run() Line 166 C++ xul.dll!nsAppShell::Run() Line 188 C++ xul.dll!nsAppStartup::Run() Line 279 C++ xul.dll!XREMain::XRE_mainRun() Line 4019 C++ xul.dll!NS_TableDrivenQI(void * aThis, const nsID & aIID, void * * aInstancePtr, const QITableEntry * entries) Line 17 C++ xul.dll!nsComponentManagerImpl::QueryInterface(const nsID & aIID, void * * aInstancePtr) Line 823 C++ xul.dll!nsQueryInterface::operator()(const nsID & aIID, void * * answer) Line 19 C++ xul.dll!nsCOMPtr_base::assign_from_qi(const nsQueryInterface qi, const nsID & iid) Line 56 C++ Faulty code: void Gamepad::SetAxis(uint32_t aAxis, double aValue) { MOZ_ASSERT(aAxis < mAxes.Length()); if (mAxes[aAxis] != aValue) { mAxes[aAxis] = aValue; GamepadBinding::ClearCachedAxesValue(this); } } Locals: + this 0x79c11fc0 {mRefCnt={mRefCntAndFlags=7 } _mOwningThread={mThread=0x06e4aeb8 } mParent={...} ...} mozilla::dom::Gamepad * aAxis 4 unsigned int aValue -1.0000000000000000 double Registers: EAX = 00000000 EBX = 0B7F4F98 ECX = 79C11FC0 EDX = A5414FD8 ESI = 00000004 EDI = A001EFD8 EIP = 5A4867F3 ESP = 0057F254 EBP = 00000000 EFL = 00210287 0xa5415000 = 0000000000000000
My debugger can not download symbol for the official release build, so I checked out the source of current release by "hg clone https://hg.mozilla.org/releases/mozilla-release firefox30" and built it myself. Reproduced with this local built Firefox 30 (page heap enabled): 0:000> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* *** WARNING: Unable to verify checksum for firefox.exe *** WARNING: Unable to verify checksum for D:\OpenSrcCode\firefox30\obj-i686-pc-mingw32\dist\bin\nss3.dll *** WARNING: Unable to verify checksum for D:\OpenSrcCode\firefox30\obj-i686-pc-mingw32\dist\bin\mozjs.dll FAULTING_IP: xul!mozilla::dom::Gamepad::SetAxis+e [d:\opensrccode\firefox30\dom\gamepad\gamepad.cpp @ 67] 5a4b93b9 f20f1044f208 movsd xmm0,mmword ptr [edx+esi*8+8] EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 5a4b93b9 (xul!mozilla::dom::Gamepad::SetAxis+0x0000000e) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: b47b6000 Attempt to read from address b47b6000 CONTEXT: 00000000 -- (.cxr 0x0;r) eax=00000000 ebx=00000000 ecx=b2e64fc8 edx=b47b5fd8 esi=00000004 edi=0b1d7fe0 eip=5a4b93b9 esp=0032f718 ebp=00000000 iopl=0 nv up ei ng nz na pe cy cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210287 xul!mozilla::dom::Gamepad::SetAxis+0xe: 5a4b93b9 f20f1044f208 movsd xmm0,mmword ptr [edx+esi*8+8] ds:002b:b47b6000=???????????????? FAULTING_THREAD: 00004b84 DEFAULT_BUCKET_ID: INVALID_POINTER_READ PROCESS_NAME: firefox.exe ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 00000000 EXCEPTION_PARAMETER2: b47b6000 READ_ADDRESS: b47b6000 FOLLOWUP_IP: xul!mozilla::dom::Gamepad::SetAxis+e [d:\opensrccode\firefox30\dom\gamepad\gamepad.cpp @ 67] 5a4b93b9 f20f1044f208 movsd xmm0,mmword ptr [edx+esi*8+8] NTGLOBALFLAG: 2000000 APPLICATION_VERIFIER_FLAGS: 0 APP: firefox.exe ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) x86fre PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ LAST_CONTROL_TRANSFER: from 5a4b9dba to 5a4b93b9 STACK_TEXT: 0032f718 5a4b9dba 00000004 00000000 bff00000 xul!mozilla::dom::Gamepad::SetAxis+0xe 0032f73c 59e47d3b 00000000 00000004 00000000 xul!mozilla::dom::GamepadService::NewAxisMoveEvent+0x3a 0032f768 59c3635c 2a600fe0 00cd6fd8 0032f7b4 xul!`anonymous namespace'::GamepadEvent::Run+0xa6 0032f7a0 59bff568 2a600fe0 00000000 0032f7bf xul!nsThread::ProcessNextEvent+0x1d4 0032f7b4 59d988c6 0171ef98 00000000 0a91af40 xul!NS_ProcessNextEvent+0x26 0032f7e0 59d8d24f 0a91af40 41f28988 10d32f98 xul!mozilla::ipc::MessagePump::Run+0x48 0032f818 59d8d1ec 0b71ef98 00000001 5ad7fe00 xul!MessageLoop::RunHandler+0x54 0032f838 5a2f35c4 11f80fc0 00000000 5a2d045d xul!MessageLoop::Run+0x19 0032f844 5a2d045d 10d32f98 00000000 11f80fc0 xul!nsBaseAppShell::Run+0x2a 0032f860 5aa2c324 10d32f98 0032fa6d 5af02ec0 xul!nsAppShell::Run+0x78 0032f870 5aa03380 11f80fc0 73ec1363 0032f964 xul!nsAppStartup::Run+0x20 0032f948 5aa01fdd 07eaafa8 0032fac8 00000001 xul!XREMain::XRE_mainRun+0x7fd 0032f964 5aa03b45 00000001 0093aff8 0032fac8 xul!XREMain::XRE_main+0xff 0032fa74 011c1854 00000001 0093aff8 0032fac8 xul!XRE_main+0x34 0032fc08 011c1494 00000001 0093aff8 07e5afa8 firefox!do_main+0x272 0032fc94 011c1ae8 00000001 0093aff8 00000001 firefox!NS_internal_main+0x133 0032fcc4 011c245a 00000001 fff97f78 008daf48 firefox!wmain+0x10b 0032fd04 75d2338a fffde000 0032fd50 779f9f72 firefox!__tmainCRTStartup+0xfd 0032fd10 779f9f72 fffde000 67c48686 00000000 kernel32!BaseThreadInitThunk+0xe 0032fd50 779f9f45 011c24c2 fffde000 00000000 ntdll!__RtlUserThreadStart+0x70 0032fd68 00000000 011c24c2 fffde000 00000000 ntdll!_RtlUserThreadStart+0x1b STACK_COMMAND: .cxr 0x0 ; kb FAULTING_SOURCE_LINE: d:\opensrccode\firefox30\dom\gamepad\gamepad.cpp FAULTING_SOURCE_FILE: d:\opensrccode\firefox30\dom\gamepad\gamepad.cpp FAULTING_SOURCE_LINE_NUMBER: 67 FAULTING_SOURCE_CODE: 63: void 64: Gamepad::SetAxis(uint32_t aAxis, double aValue) 65: { 66: MOZ_ASSERT(aAxis < mAxes.Length()); > 67: if (mAxes[aAxis] != aValue) { 68: mAxes[aAxis] = aValue; 69: GamepadBinding::ClearCachedAxesValue(this); 70: } 71: } 72: SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: xul!mozilla::dom::Gamepad::SetAxis+e FOLLOWUP_NAME: MachineOwner MODULE_NAME: xul IMAGE_NAME: xul.dll DEBUG_FLR_IMAGE_TIMESTAMP: 53b0dcbb FAILURE_BUCKET_ID: INVALID_POINTER_READ_c0000005_xul.dll!mozilla::dom::Gamepad::SetAxis BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_xul!mozilla::dom::Gamepad::SetAxis+e ANALYSIS_SOURCE: UM FAILURE_ID_HASH_STRING: um:invalid_pointer_read_c0000005_xul.dll!mozilla::dom::gamepad::setaxis FAILURE_ID_HASH: {f7af1fe4-92cf-5220-382e-0a6f6a14ab14} Followup: MachineOwner ---------
Flags: sec-bounty?
Whiteboard: [reporter-external]
Component: Untriaged → Hardware Abstraction Layer (HAL)
Product: Firefox → Core
Ted: please confirm and if not you find an appropriate owner.
Assignee: nobody → ted
Flags: needinfo?(ted)
I'll try to reproduce this week (was on vacation last week). Note that this code has been rewritten in bug 996078, which landed for the 32 branch (currently Aurora).
status-firefox32: --- → unaffected
status-firefox33: --- → unaffected
Flags: needinfo?(ted)
Can someone please confirm it first? Firefox 31 is already out now without fixing this security issue. I know one option is to wait until all users upgrade to Firefox 32 or higher. But can you please confirm it first. Whether to fix it or not is another decision. I believe we all don't want to see an easily reproduced security issue in stable release takes more than one month to confirm.
It sounds like this doesn't affect any released version, but it did at the time it was reported.
Status: UNCONFIRMED → RESOLVED
Closed: 12 years ago
status-firefox31: --- → wontfix
Resolution: --- → WORKSFORME
(In reply to Andrew McCreight [:mccr8] from comment #6) > It sounds like this doesn't affect any released version, but it did at the > time it was reported. It affected the release version (30) when this bug was reported, for now it still affects the current release(31). We can still see the memory corruption reliably in current release(31)： First-chance exception at 0x77D3E41B (ntdll.dll) in firefox.exe: 0xC0000005: Access violation writing location 0x75FA4D39. Unhandled exception at 0x77D3E41B (ntdll.dll) in firefox.exe: 0xC0000005: Access violation writing location 0x75FA4D39. ntdll.dll!@RtlpLowFragHeapFree@8() Unknown ntdll.dll!_RtlFreeHeap@12() Unknown kernel32.dll!_HeapFree@12() Unknown > msvcr110.dll!free(void * pBlock) Line 51 C xul.dll!nsXPCComponents_Classes::NewResolve(nsIXPConnectWrappedNative * wrapper, JSContext * cx, JSObject * objArg, jsid idArg, JSObject * * objp, bool * _retval) Line 834 C++ xul.dll!XPC_WN_Helper_NewResolve(JSContext * cx, JS::Handle<JSObject *> obj, JS::Handle<jsid> id, JS::MutableHandle<JSObject *> objp) Line 896 C++ mozjs.dll!js::baseops::GetProperty(JSContext * cx, JS::Handle<JSObject *> obj, JS::Handle<JSObject *> receiver, JS::Handle<jsid> id, JS::MutableHandle<JS::Value> vp) Line 4507 C++ mozjs.dll!GetPropertyOperation(JSContext * cx, js::InterpreterFrame * fp, JS::Handle<JSScript *> script, unsigned char * pc, JS::MutableHandle<JS::Value> lval, JS::MutableHandle<JS::Value> vp) Line 265 C++ mozjs.dll!Interpret(JSContext * cx, js::RunState & state) Line 2415 C++ mozjs.dll!js::RunScript(JSContext * cx, js::RunState & state) Line 422 C++ mozjs.dll!js::Invoke(JSContext * cx, JS::CallArgs args, js::MaybeConstruct construct) Line 497 C++ mozjs.dll!js::Invoke(JSContext * cx, const JS::Value & thisv, const JS::Value & fval, unsigned int argc, const JS::Value * argv, JS::MutableHandle<JS::Value> rval) Line 531 C++ mozjs.dll!JS::Call(JSContext * cx, JS::Handle<JS::Value> thisv, JS::Handle<JS::Value> fval, const JS::HandleValueArray & args, JS::MutableHandle<JS::Value> rval) Line 5076 C++ xul.dll!mozilla::dom::EventHandlerNonNull::Call(JSContext * cx, JS::Handle<JS::Value> aThisVal, mozilla::dom::Event & event, JS::MutableHandle<JS::Value> aRetVal, mozilla::ErrorResult & aRv) Line 36 C++ xul.dll!mozilla::dom::EventHandlerNonNull::Call<nsISupports *>(nsISupports * const & thisObjPtr, mozilla::dom::Event & event, JS::MutableHandle<JS::Value> aRetVal, mozilla::ErrorResult & aRv, mozilla::dom::CallbackObject::ExceptionHandling aExceptionHandling) Line 62 C++ xul.dll!mozilla::JSEventHandler::HandleEvent(nsIDOMEvent * aEvent) Line 216 C++ xul.dll!nsXBLPrototypeHandler::ExecuteHandler(mozilla::dom::EventTarget * aTarget, nsIDOMEvent * aEvent) Line 336 C++ xul.dll!nsXBLEventHandler::HandleEvent(nsIDOMEvent * aEvent) Line 49 C++ xul.dll!mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener * aListener, nsIDOMEvent * aDOMEvent, mozilla::dom::EventTarget * aCurrentTarget) Line 950 C++ xul.dll!mozilla::EventListenerManager::HandleEventInternal(nsPresContext * aPresContext, mozilla::WidgetEvent * aEvent, nsIDOMEvent * * aDOMEvent, mozilla::dom::EventTarget * aCurrentTarget, nsEventStatus * aEventStatus) Line 1012 C++ xul.dll!mozilla::EventListenerManager::HandleEvent(nsPresContext * aPresContext, mozilla::WidgetEvent * aEvent, nsIDOMEvent * * aDOMEvent, mozilla::dom::EventTarget * aCurrentTarget, nsEventStatus * aEventStatus) Line 328 C++ xul.dll!mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor & aVisitor, mozilla::ELMCreationDetector & aCd) Line 197 C++ xul.dll!mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem> & aChain, mozilla::EventChainPostVisitor & aVisitor, mozilla::EventDispatchingCallback * aCallback, mozilla::ELMCreationDetector & aCd) Line 310 C++ xul.dll!mozilla::EventDispatcher::Dispatch(nsISupports * aTarget, nsPresContext * aPresContext, mozilla::WidgetEvent * aEvent, nsIDOMEvent * aDOMEvent, nsEventStatus * aEventStatus, mozilla::EventDispatchingCallback * aCallback, nsCOMArray<mozilla::dom::EventTarget> * aTargets) Line 602 C++ xul.dll!mozilla::EventDispatcher::DispatchDOMEvent(nsISupports * aTarget, mozilla::WidgetEvent * aEvent, nsIDOMEvent * aDOMEvent, nsPresContext * aPresContext, nsEventStatus * aEventStatus) Line 662 C++ xul.dll!mozilla::DOMEventTargetHelper::DispatchDOMEvent(mozilla::WidgetEvent * aEvent, nsIDOMEvent * aDOMEvent, nsPresContext * aPresContext, nsEventStatus * aEventStatus) Line 321 C++ xul.dll!nsContentUtils::DispatchChromeEvent(nsIDocument * aDoc, nsISupports * aTarget, const nsAString_internal & aEventName, bool aCanBubble, bool aCancelable, bool * aDefaultAction) Line 3420 C++ xul.dll!nsDocument::DoNotifyPossibleTitleChange() Line 6810 C++ xul.dll!nsRunnableMethodImpl<void (__thiscall nsPACMan::*)(void),void,1>::Run() Line 388 C++ xul.dll!nsThread::ProcessNextEvent(bool mayWait, bool * result) Line 715 C++ xul.dll!NS_ProcessNextEvent(nsIThread * thread, bool mayWait) Line 263 C++ xul.dll!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate * aDelegate) Line 95 C++ xul.dll!MessageLoop::RunHandler() Line 223 C++ xul.dll!MessageLoop::Run() Line 197 C++ xul.dll!nsBaseAppShell::Run() Line 166 C++ xul.dll!nsAppShell::Run() Line 188 C++ xul.dll!nsAppStartup::Run() Line 279 C++ xul.dll!XREMain::XRE_mainRun() Line 4019 C++ xul.dll!NS_TableDrivenQI(void * aThis, const nsID & aIID, void * * aInstancePtr, const QITableEntry * entries) Line 17 C++ xul.dll!nsComponentManagerImpl::QueryInterface(const nsID & aIID, void * * aInstancePtr) Line 823 C++ xul.dll!nsQueryInterface::operator()(const nsID & aIID, void * * answer) Line 19 C++ xul.dll!nsCOMPtr_base::assign_from_qi(const nsQueryInterface qi, const nsID & iid) Line 56 C++ Firefox version: 31.0 Operating System: Windows 7 64 bit with virtual gamepad driver vJoy
Thanks for checking. At this point, we're unlikely to release a new version of 31 to fix this issue, so we'll just wait on 32 to be released in a few weeks.
If we don't know what fixed this can we be confident it's not going to come back?
Flags: needinfo?(kamiljoz)
Kamil (or mwobensmith): Can you verify that this is a problem in Firefox 31 and is fixed in 32?
Flags: needinfo?(kamiljoz)
(In reply to Daniel Veditz [:dveditz] from comment #9) > If we don't know what fixed this can we be confident it's not going to come > back? This was fixed by a code rewrite in bug 996078. The code is no longer multithreaded.
Flags: needinfo?(ted)
I couldn't reproduce the original issue using the code from comment #0, I went through the following: Before doing anything, I downloaded the latest version of the vJoy driver and installed it (used my main Win 8.1 desktop machine) I opened the POC code from comment #0 in the following builds and couldn't reproduce the issue: (never received any crashes or hangs) - http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/30.0/ - http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/31.0/ - http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/32.0b1/ - http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/32.0b9/ For each of the above builds, I also went through the following: - gflags.exe /p /enable "c:\Program Files (x86)\Mozilla Firefox\firefox.exe" /full (Enabling full page heap verification) - Downloaded the needed symbols for windbg.exe using the following guide: https://developer.mozilla.org/en/docs/How_to_get_a_stacktrace_with_WinDbg - Once the symbols were downloaded, I opened firefox.exe using windbg.exe and opened several instance of the code from comment #0 Ted/Looben, is there something I'm doing wrong or perhaps missing a step? Should I be able to reproduce the original problem by simply opening the POC code in FX?
Flags: needinfo?(kamiljoz)
Flags: needinfo?(ted)
Flags: needinfo?(loobenyang)
The reproduce steps are the same with the previous bug:https://bugzilla.mozilla.org/show_bug.cgi?id=1011859 . Let me know if Ted can't replicate it.
Flags: needinfo?(loobenyang)
(In reply to Kamil Jozwiak [:kjozwiak] from comment #12) > I couldn't reproduce the original issue using the code from comment #0, I > went through the following: > > Before doing anything, I downloaded the latest version of the vJoy driver > and installed it (used my main Win 8.1 desktop machine) > > I opened the POC code from comment #0 in the following builds and couldn't > reproduce the issue: (never received any crashes or hangs) > - http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/30.0/ > - http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/31.0/ > - http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/32.0b1/ > - http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/32.0b9/ > > For each of the above builds, I also went through the following: > > - gflags.exe /p /enable "c:\Program Files (x86)\Mozilla Firefox\firefox.exe" > /full (Enabling full page heap verification) > - Downloaded the needed symbols for windbg.exe using the following guide: > https://developer.mozilla.org/en/docs/How_to_get_a_stacktrace_with_WinDbg > - Once the symbols were downloaded, I opened firefox.exe using windbg.exe > and opened several instance of the code from comment #0 > > Ted/Looben, is there something I'm doing wrong or perhaps missing a step? > Should I be able to reproduce the original problem by simply opening the POC > code in FX? Quite interesting, you can reproduce the previous bug Bug 1011859 , I see your name on that bug. I didn't change my machine configuration so basically the environment and steps should be the same. I just have a tried and still be able to reproduce it with official 31 release build (I failed to download symbol on this machine so you can just ignore the stack here. I also attached a minidump generated from the latest 31 official build, you can see all the information after loading your symbols): (26d0.363c): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files (x86)\Mozilla Firefox\xul.dll - eax=03ae9648 ebx=00000001 ecx=5a5a5a5a edx=0313746e esi=003bf43c edi=131466d0 eip=027fe83f esp=003bf408 ebp=12faa1e8 iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 xul!NS_Alloc+0x88428: 027fe83f 8b5124 mov edx,dword ptr [ecx+24h] ds:002b:5a5a5a7e=???????? 0:000> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Users\Looben.Yang.NZ\AppData\Roaming\TaobaoProtect\TaobaoProtectSE.dll - FAULTING_IP: xul!NS_Alloc+88428 027fe83f 8b5124 mov edx,dword ptr [ecx+24h] EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 027fe83f (xul!NS_Alloc+0x00088428) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: 5a5a5a7e Attempt to read from address 5a5a5a7e CONTEXT: 00000000 -- (.cxr 0x0;r) eax=03ae9648 ebx=00000001 ecx=5a5a5a5a edx=0313746e esi=003bf43c edi=131466d0 eip=027fe83f esp=003bf408 ebp=12faa1e8 iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 xul!NS_Alloc+0x88428: 027fe83f 8b5124 mov edx,dword ptr [ecx+24h] ds:002b:5a5a5a7e=???????? FAULTING_THREAD: 0000363c PROCESS_NAME: firefox.exe ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 00000000 EXCEPTION_PARAMETER2: 5a5a5a7e READ_ADDRESS: 5a5a5a7e FOLLOWUP_IP: xul!NS_Alloc+88428 027fe83f 8b5124 mov edx,dword ptr [ecx+24h] NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 APP: firefox.exe ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) x86fre BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ_FILL_PATTERN_5a5a5a5a PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ_FILL_PATTERN_5a5a5a5a DEFAULT_BUCKET_ID: INVALID_POINTER_READ_FILL_PATTERN_5a5a5a5a LAST_CONTROL_TRANSFER: from 0283b0f3 to 027fe83f STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. 003bf414 0283b0f3 03db9580 131466d0 003bf43c xul!NS_Alloc+0x88428 003bf458 757a8730 000007de 03db9580 00c8f000 xul!NS_Alloc+0xc4cdc 003bf484 0273b295 00000021 0292a7ea 1bad42f3 KERNELBASE!SystemTimeToFileTime+0x50 003bf494 0292a7fd 00000001 00001701 510910c0 xul!NS_NewLocalFile+0x9985 003bf4ac 02950915 00000001 00001701 00001770 xul!RegisterStrongMemoryReporter+0x4f1e 003bf4d4 02950ac7 00000001 0ae18440 0295099b xul!RegisterWeakMemoryReporter+0x2974 003bf4f8 027b51e7 0ae18440 00000000 00c1b240 xul!RegisterWeakMemoryReporter+0x2b26 003bf514 027b5114 028513b6 0a86d060 003bf5d4 xul!NS_Alloc+0x3edd0 003bf518 028513b6 0a86d060 003bf5d4 00c0e9b0 xul!NS_Alloc+0x3ecfd 003bf58c 510ae528 00c057ac 027cbc04 0287208d xul!NS_CycleCollectorSuspect3+0xf046 003bf594 027cbc04 0287208d 00c1b201 00000001 nss3!PR_Unlock+0x38 003bf5a8 02a6e5ab 00c1b201 00000001 00c2d1a0 xul!NS_Alloc+0x557ed 003bf5d4 02a61e6c 00c2d1a0 1bad40c7 00c1b240 xul!JSD_GetContextFlags+0x60bef 003bf5f4 02c70430 003bfae8 02fabec9 1854b883 xul!JSD_GetContextFlags+0x544b0 003bf60c 02a61ef6 00c1bc50 00000001 003bf600 xul!imgLoader::SupportImageWithMimeType+0x53942 003bf62c 029c07b3 80000000 08df2400 029db11e xul!JSD_GetContextFlags+0x5453a 003bf6b4 0296c6e5 00000022 01010011 00c1e400 xul!NS_GetComponentManager+0x9402 003bf6d8 0276ac89 00c57100 003bf704 003bf720 xul!NS_InitXPCOM2+0x43f 003bf6e8 02843eaa 00c57100 03aedd2c 003bf70c xul!NS_NewLocalFile+0x39379 003bf720 029b24fc 003bf760 003bf888 003bf760 xul!NS_CycleCollectorSuspect3+0x1b3a 003bf740 029c894e 003bf760 00000000 005f79c0 xul!XRE_AddManifestLocation+0x8214 003bf858 012d16dd 00000001 005f79c0 003bf888 xul!XRE_main+0x30 003bf9ec 012d19a2 00000001 005f79c0 00c1e100 firefox!do_main+0x283 003bfa80 012d1aad 00000001 005f79c0 00000000 firefox!NS_internal_main+0x11d 003bfab4 012d237b 00000000 005b7e20 005b96d0 firefox!wmain+0xf0 003bfaf8 753c338a fffde000 003bfb44 778c9f72 firefox!__tmainCRTStartup+0x122 003bfb04 778c9f72 fffde000 731069b9 00000000 kernel32!BaseThreadInitThunk+0xe 003bfb44 778c9f45 012d249c fffde000 00000000 ntdll!__RtlUserThreadStart+0x70 003bfb5c 00000000 012d249c fffde000 00000000 ntdll!_RtlUserThreadStart+0x1b STACK_COMMAND: .cxr 0x0 ; kb SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: xul!NS_Alloc+88428 FOLLOWUP_NAME: MachineOwner MODULE_NAME: xul IMAGE_NAME: xul.dll DEBUG_FLR_IMAGE_TIMESTAMP: 53c75e14 FAILURE_BUCKET_ID: INVALID_POINTER_READ_FILL_PATTERN_5a5a5a5a_c0000005_xul.dll!NS_Alloc BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_FILL_PATTERN_5a5a5a5a_xul!NS_Alloc+88428 ANALYSIS_SOURCE: UM FAILURE_ID_HASH_STRING: um:invalid_pointer_read_fill_pattern_5a5a5a5a_c0000005_xul.dll!ns_alloc FAILURE_ID_HASH: {cbe35194-8018-549b-b4ab-b62e8e2e3899} Followup: MachineOwner ---------
Also, per my tests, page heap doesn't work for the official build (can still see crash, but cann't catch the place where the first buffer overrun occurs), but it does work for local build (check out the code, build it myself and run it with visual studio, and page heap can catch the buffer overrun).
(In reply to Kamil Jozwiak [:kjozwiak] from comment #12) > I couldn't reproduce the original issue using the code from comment #0, I > went through the following: > > Before doing anything, I downloaded the latest version of the vJoy driver > and installed it (used my main Win 8.1 desktop machine) > > I opened the POC code from comment #0 in the following builds and couldn't > reproduce the issue: (never received any crashes or hangs) > - http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/30.0/ > - http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/31.0/ > - http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/32.0b1/ > - http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/32.0b9/ > > For each of the above builds, I also went through the following: > > - gflags.exe /p /enable "c:\Program Files (x86)\Mozilla Firefox\firefox.exe" > /full (Enabling full page heap verification) > - Downloaded the needed symbols for windbg.exe using the following guide: > https://developer.mozilla.org/en/docs/How_to_get_a_stacktrace_with_WinDbg > - Once the symbols were downloaded, I opened firefox.exe using windbg.exe > and opened several instance of the code from comment #0 > > Ted/Looben, is there something I'm doing wrong or perhaps missing a step? > Should I be able to reproduce the original problem by simply opening the POC > code in FX? Forgot to explicitly answer your last question. Yes, simply opening the POC code in Firefox reproduces it. This bug exploit the race condition, so probably it's not 100% success for each run. Run official Firefox 31 without Windbg, I have about 90% chance to crash it; Run official Firefox 31 within Windbg, the success rate is about 50%. I got almost 100% success rate with local built Firefox before. However, for each run, you need to restart the browser instead of simply open a new tab. I remember from my debugging for the previous bug, the second and subsequent instances do not hit the code. So your method of "opened several instance of the code from comment #0" probably doesn't help the reproduce.
I tried some basic testing here and wasn't able to reproduce it, but maybe I'm just not persistent enough or not following the STR properly. In any event, I think we're just going to let this get fixed in 32 by the backend rewrite. (In reply to Looben Yang from comment #16) > This bug exploit the race condition, so probably it's not 100% success for > each run. > Run official Firefox 31 without Windbg, I have about 90% chance to crash it; > Run official Firefox 31 within Windbg, the success rate is about 50%. > I got almost 100% success rate with local built Firefox before. If your local builds aren't built with PGO that could explain the discrepancy here. The PGO codegen can be quite different.
Flags: needinfo?(ted)
Kamil, I just tried it on another machine, my Win8 laptop. It can not be reproduced either at first. However, after unchecked one "Y" in configure vjoy like what you did for the previous bug Bug 1011859 ('unchecked Y and Z under "Configure vJoy"'), I can be reproduced.
What I got with my windows 8 laptop(also attached the minidump): (2d34.21b4): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=bff00000 ebx=10749340 ecx=095759d0 edx=0028c6dc esi=bff00010 edi=bff00000 eip=5eb304a5 esp=0028c5f0 ebp=0028c694 iopl=0 nv up ei ng nz na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010286 gkmedias!_moz_cairo_surface_reference+0xd: 5eb304a5 833eff cmp dword ptr [esi],0FFFFFFFFh ds:002b:bff00010=???????? 0:000> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* FAULTING_IP: gkmedias!_moz_cairo_surface_reference+d [c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\gfx\cairo\cairo\src\cairo-surface.c @ 615] 5eb304a5 833eff cmp dword ptr [esi],0FFFFFFFFh EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 5eb304a5 (gkmedias!_moz_cairo_surface_reference+0x0000000d) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: bff00010 Attempt to read from address bff00010 CONTEXT: 00000000 -- (.cxr 0x0;r) eax=bff00000 ebx=10749340 ecx=095759d0 edx=0028c6dc esi=bff00010 edi=bff00000 eip=5eb304a5 esp=0028c5f0 ebp=0028c694 iopl=0 nv up ei ng nz na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010286 gkmedias!_moz_cairo_surface_reference+0xd: 5eb304a5 833eff cmp dword ptr [esi],0FFFFFFFFh ds:002b:bff00010=???????? FAULTING_THREAD: 000021b4 DEFAULT_BUCKET_ID: INVALID_POINTER_READ PROCESS_NAME: firefox.exe ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 00000000 EXCEPTION_PARAMETER2: bff00010 READ_ADDRESS: bff00010 FOLLOWUP_IP: gkmedias!_moz_cairo_surface_reference+d [c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\gfx\cairo\cairo\src\cairo-surface.c @ 615] 5eb304a5 833eff cmp dword ptr [esi],0FFFFFFFFh NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 APP: firefox.exe ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) x86fre PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ LAST_CONTROL_TRANSFER: from 594703ae to 5eb304a5 STACK_TEXT: 0028c5f4 594703ae bff00000 00000002 597c76e0 gkmedias!_moz_cairo_surface_reference+0xd 0028c600 597c76e0 597c94d2 0028c70c 00000001 xul!gfxASurface::AddRef+0x1e 0028c604 597c94d2 0028c70c 00000001 00000000 xul!imgFrame::GetSurface+0x16 0028c6f0 597ca7a8 107cd400 07f212e0 00000001 xul!mozilla::image::RasterImage::DrawWithPreDownscaleIfNeeded+0xbc 0028c740 59341faf 01749340 07f212e0 00000001 xul!mozilla::image::RasterImage::Draw+0x13f 0028c868 59341d98 08cde580 00000001 0028c8c8 xul!DrawImageInternal+0x1df 0028c8d8 59449776 08cde580 10749340 00000001 xul!nsLayoutUtils::DrawSingleImage+0x108 0028c950 5945a429 08cde580 10f4cb3c 00000010 xul!nsImageBoxFrame::PaintImage+0xd6 0028c970 5936e85f 0028d130 08cde580 08cde580 xul!nsDisplayXULImage::Paint+0x3c 0028ca50 59c6c7b0 06ca8470 10f4e408 0028cbf8 xul!mozilla::FrameLayerBuilder::PaintItems+0x21f 0028cc50 59fa1bcb 0dd79060 07f212e0 0028cd70 xul!mozilla::FrameLayerBuilder::DrawThebesLayer+0x919cf0 0028cce4 5a280171 0dd79060 0028cd70 3f800002 xul!mozilla::layers::ThebesLayerD3D10::DrawRegion+0x16f 0028cdc8 5a2805e2 0dd79060 0028cde4 5a6e4c08 xul!mozilla::layers::ThebesLayerD3D10::Validate+0x33b 0028ce50 5a12e9f5 5a6e4c08 0e10f6d0 10f4e800 xul!mozilla::layers::ContainerLayerD3D10::Validate+0x133 0028cf30 5a12ec56 0e10f6d0 00000002 10f4e800 xul!mozilla::layers::LayerManagerD3D10::Render+0x24 0028cf94 5936172e 59352ac0 0028d130 00000002 xul!mozilla::layers::LayerManagerD3D10::EndTransaction+0x59 0028d06c 59360fdc 0028d0a4 0028d130 0000000d xul!nsDisplayList::PaintForFrame+0x49e 0028d42c 593493dc 00000000 08c642b8 0028d564 xul!nsLayoutUtils::PaintFrame+0x52c 0028d544 5933fa46 08ccf0b0 0028d564 00000001 xul!PresShell::Paint+0x1dc 0028d578 5943c53b 00000002 08cce4f0 0028d5b0 xul!nsViewManager::ProcessPendingUpdatesPaint+0xe6 0028d598 5931bcba 08cce4f0 00000001 08cce4f0 xul!nsViewManager::ProcessPendingUpdatesForView+0xfb 0028d5b0 5941dd94 00000000 00000008 2964b069 xul!nsViewManager::ProcessPendingUpdates+0x35 0028d76c 59330d52 08aaf880 2964b069 000501b6 xul!nsRefreshDriver::Tick+0x6e4 0028d7c8 593551e7 08178500 07fe36d0 00a1b240 xul!mozilla::RefreshDriverTimer::Tick+0x102 0028d7e4 59355114 593f13b6 084390c0 0028dbb0 xul!nsTimerImpl::Fire+0xc7 0028d7e8 593f13b6 084390c0 0028dbb0 0968e9e0 xul!nsTimerEvent::Run+0x14 0028d868 5941208d 00a1b201 00000001 0028d880 xul!nsThread::ProcessNextEvent+0x3b6 0028d878 59c98e0b 00a1b201 00000001 0028dc60 xul!NS_ProcessNextEvent+0x2d 0028dbb0 5a1bc575 00000000 0028dbc4 0000003f xul!nsXMLHttpRequest::Send+0x99d9c9 0028dbd0 5a1bc61a 0968e9e0 0028dc60 0028dc24 xul!nsXMLHttpRequest::Send+0x1c 0028dbf4 59c99396 0968e9e0 0028dc24 0028dc60 xul!nsXMLHttpRequest::Send+0x22 0028dc98 59594af3 084dcc80 0028dcd4 0968e9e0 xul!mozilla::dom::XMLHttpRequestBinding::send+0x79059c 0028dcd4 60941cc1 084dcc80 00000001 00000244 xul!mozilla::dom::GenericBindingMethod+0xc3 0028e028 609433f8 084dcc80 00000000 06ccc118 mozjs!js::Invoke+0x71 0028eb20 60941f43 09374880 084dcc80 0028efc8 mozjs!Interpret+0x718 0028ee68 60942bd8 084dcc80 00000000 0028eed0 mozjs!js::Invoke+0x2f3 0028ef0c 60976261 084dcc80 0028ef98 0028ef78 mozjs!js::Invoke+0x188 0028ef34 59440ead 084dcc80 0028ef98 0028ef78 mozjs!JS::Call+0x21 0028f004 594351e2 0e3cd800 0028f038 0d833730 xul!mozilla::dom::EventListener::HandleEvent+0x1ed 0028f110 5941a1f2 0028f154 0d833730 0028f298 xul!mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget *>+0xb2 0028f144 593da4c9 094807c0 0d833730 094831a0 xul!mozilla::EventListenerManager::HandleEventSubType+0x102 0028f1b8 593e35b5 094807c0 11860800 0028f308 xul!mozilla::EventListenerManager::HandleEventInternal+0x219 0028f1f0 593e4ac0 0028f218 00000009 00000000 xul!mozilla::EventTargetChainItem::HandleEventTargetChain+0x215 0028f2bc 59461814 0dfb6010 11860800 0028f308 xul!mozilla::EventDispatcher::Dispatch+0xb70 0028f350 5932b768 10f820e0 00000000 0df37414 xul!nsDocumentViewer::LoadComplete+0x282 0028f580 59444e96 0df37414 118701dc 00000000 xul!nsDocShell::EndPageLoad+0xf8 0028f5a0 5941011d 118701dc 10f82030 00001000 xul!nsDocShell::OnStateChange+0x126 0028f5cc 593e4d3e 0dfb6000 593fbff8 00000002 xul!nsIOService::URIChainHasFlags+0x2d 0028f604 5933dc59 08a6fc40 0028f65c 0028f664 xul!nsCOMPtr_base::~nsCOMPtr_base+0xe 0028f618 593fa990 0df37400 0028f664 593e39f5 xul!NS_TableDrivenQI+0x59 0028f62c 5942765a 0df374d0 0df37414 118701dc xul!nsDocShell::QueryInterface+0xe0 0028f66c 59321741 0df37414 118701dc 0028f6c8 xul!nsDocLoader::DoFireOnStateChange+0xea 0028f6bc 59337120 0df37400 00020010 00000000 xul!nsDocLoader::doStopDocumentLoad+0x91 0028f6fc 59368cb8 00000001 0df8c520 00000000 xul!nsDocLoader::DocLoaderIsEmpty+0x194 0028f720 593806ab 0df37400 00000000 00000000 xul!nsDocLoader::OnStopRequest+0xe8 0028f784 592d5971 0df8c520 0e1f4ae8 00000000 xul!nsLoadGroup::RemoveRequest+0xcb 0028f7ac 592d58ae 00000021 11874000 00000000 xul!nsDocument::DoUnblockOnload+0x4b 0028f7cc 5932c501 00000001 00000002 00a1b240 xul!nsDocument::UnblockOnload+0x62 0028f82c 59432106 593f13b6 0ddeac80 0028f8ec xul!nsDocument::DispatchContentLoadedEvents+0x18f 0028f830 593f13b6 0ddeac80 0028f8ec 00a0e9b0 xul!nsRunnableMethodImpl<void (__thiscall nsDocument::*)(void),void,1>::Run+0x26 0028f8b0 5941208d 00a1b201 00000000 0028f8c8 xul!nsThread::ProcessNextEvent+0x3b6 0028f8c0 5960e556 00a1b201 00000000 00a26280 xul!NS_ProcessNextEvent+0x2d 0028f8ec 59601e6c 01a26280 8f3b5121 00a1b240 xul!mozilla::ipc::MessagePump::Run+0x46 0028f924 59601ef6 00a1bc50 00000001 0028f900 xul!MessageLoop::RunHandler+0x51 0028f944 595607b3 80000000 06742300 5957b11e xul!MessageLoop::Run+0x19 0028f950 5957b11e 00a1bc50 59b347bc 00a1bc50 xul!nsBaseAppShell::Run+0x2c 0028f964 594f5c15 06742300 63911306 0028fa78 xul!nsAppShell::Run+0x19 0028fa38 595524fc 0028fa78 0028fba0 0028fa78 xul!XREMain::XRE_mainRun+0x453 0028fa58 5956894e 0028fa78 00000000 005d6798 xul!XREMain::XRE_main+0xe8 0028fb70 013516dd 00000001 005d6798 0028fba0 xul!XRE_main+0x30 0028fd04 013519a2 00000001 005d6798 00a1e100 firefox!do_main+0x283 0028fd98 01351aad 00000001 005d6798 00000000 firefox!NS_internal_main+0x11d 0028fdcc 0135237b 00000000 005d29f8 005d28e0 firefox!wmain+0xf0 0028fe10 760286e3 ff767000 0028fe60 7714be99 firefox!__tmainCRTStartup+0x122 0028fe1c 7714be99 ff767000 a2cca4e0 00000000 KERNEL32!BaseThreadInitThunk+0xe 0028fe60 7714be6c 0135249c ff767000 ffffffff ntdll!__RtlUserThreadStart+0x72 0028fe78 00000000 0135249c ff767000 00000000 ntdll!_RtlUserThreadStart+0x1b STACK_COMMAND: dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; .cxr 0x0 ; kb FAULTING_SOURCE_LINE: c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\gfx\cairo\cairo\src\cairo-surface.c FAULTING_SOURCE_FILE: c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\gfx\cairo\cairo\src\cairo-surface.c FAULTING_SOURCE_LINE_NUMBER: 615 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: gkmedias!_moz_cairo_surface_reference+d FOLLOWUP_NAME: MachineOwner MODULE_NAME: gkmedias IMAGE_NAME: gkmedias.dll DEBUG_FLR_IMAGE_TIMESTAMP: 53c73bb0 FAILURE_BUCKET_ID: INVALID_POINTER_READ_c0000005_gkmedias.dll!_moz_cairo_surface_reference BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_gkmedias!_moz_cairo_surface_reference+d ANALYSIS_SOURCE: UM FAILURE_ID_HASH_STRING: um:invalid_pointer_read_c0000005_gkmedias.dll!_moz_cairo_surface_reference FAILURE_ID_HASH: {f40b722d-55f3-329f-80bb-3014c8d0eded} Followup: MachineOwner ---------
Kamil, Have you tried it again using the instructions in previous bug?
Flags: needinfo?(kamiljoz)
Looben, Seems like I can't reproduce the problem. I've tried using the official build that I downloaded directly from Mozilla and I've also built FX 31 from source using changeset 32dddf30405a. On both accounts, I couldn't crash the browser by simply opening the POC from comment #0. I've also tried disabling the "Z" and "Y" axis as per comment #18 without luck, here are the cases I went through on both builds: Note: the poc was opened 15x on each of the computers for each case (closed/re-opened fx every time) - opened the poc with X, Y and Z axis enabled under "Configure vJoy" - opened the poc with X, Z axis enabled under "Configure vJoy" - opened the poc with Y, Z axis enabled under "Configure vJoy" - opened the poc with X axis enabled under "Configure vJoy" - opened the poc with Y axis enabled under "Configure vJoy" - opened the poc with Z axis enabled under "Configure vJoy" Machines Used: - Surface Pro 2 using Win 8.1 - Couldn't reproduce with the official EXE build - Lenovo X1 Carbon laptop using Win 8.1 - Couldn't reproduce with the official EXE build - Desktop using Win 8.1 - Couldn't reproduce with the official EXE build and the build that I built using changset 32dddf30405a - Several VM's using Win 8.1 - Couldn't reproduce with the official EXE build I'm not sure what I'm doing differently, but I can't get it to crash. The closest I've been to coming to a "crash" is when I had "ac_add_options --enable-debug" enabled under .mozconfig and received the "script is not responding" error message while fx stalled. Once I selected "Stop Script", fx worked fine without crashing.
Flags: needinfo?(kamiljoz)
(In reply to Kamil Jozwiak [:kjozwiak] from comment #21) > Looben, > > Seems like I can't reproduce the problem. I've tried using the official Thanks Kamil. Interesting. I just unstalled my vJoy driver and re installed it (vJoy_x86x64_I210414.exe) again on my win8 laptop. By default 6 devices with name "HID-compliant game controller" were installed under Human Interface Devices. I tried without any vjoy configuration it didn't reproduce. After unticked the Y in Basic Axes for Target Device 1, I got the crash by opening Bof_SetAxis_Repro.html: Accessibility: Active AdapterDeviceID: 0x990b AdapterVendorID: 0x1002 Add-ons: %7B1B33E42F-EF14-4cd3-B6DC-174571C4349C%7D:4.7,%7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:31.0 AvailablePageFile: 17991942144 AvailablePhysicalMemory: 11758108672 AvailableVirtualMemory: 3786772480 BIOS_Manufacturer: Insyde BlockedDllList: BreakpadReserveAddress: 41156608 BreakpadReserveSize: 41943040 BuildID: 20140716183446 CrashTime: 1410293602 EMCheckCompatibility: true FramePoisonBase: 00000000f0de0000 FramePoisonSize: 65536 InstallTime: 1410293290 Notes: AdapterVendorID: 0x1002, AdapterDeviceID: 0x990b, AdapterSubsysID: 198a103c, AdapterDriverVersion: 12.101.0.0 D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ ProductID: {ec8030f7-c20a-464f-9b0e-13a3a9e97384} ProductName: Firefox ReleaseChannel: release SecondsSinceLastCrash: 298 StartupTime: 1410293598 SystemMemoryUsePercentage: 28 Theme: classic/1.0 Throttleable: 1 TotalPageFile: 24922558464 TotalPhysicalMemory: 16332623872 TotalVirtualMemory: 4294836224 URL: file:///E:/Bof_SetAxis_Repro.html Vendor: Mozilla Version: 31.0 Winsock_LSP: MSAFD Tcpip [TCP/IP] : 2 : 1 : MSAFD Tcpip [UDP/IP] : 2 : 2 : %SystemRoot%\system32\mswsock.dll MSAFD Tcpip [RAW/IP] : 2 : 3 : MSAFD Tcpip [TCP/IPv6] : 2 : 1 : %SystemRoot%\system32\mswsock.dll MSAFD Tcpip [UDP/IPv6] : 2 : 2 : MSAFD Tcpip [RAW/IPv6] : 2 : 3 : %SystemRoot%\system32\mswsock.dll RSVP TCPv6 Service Provider : 2 : 1 : RSVP TCP Service Provider : 2 : 1 : %SystemRoot%\system32\mswsock.dll RSVP UDPv6 Service Provider : 2 : 2 : RSVP UDP Service Provider : 2 : 2 : %SystemRoot%\system32\mswsock.dll MSAFD RfComm [Bluetooth] : 2 : 1 : useragent_locale: en-US This report also contains technical information about the state of the application when it crashed.
Please check device manger to make sure that you have some Gamepads. If you only have "vJoy Device", probably you need to add some Gamepads using the "Configure vJoy", change Target Device to 2 ( and 3, 4 , 5...) and select Action as "Configure" can add gamepads. May need to restart computer after the configuration. Once you see a few "HID-compliant game controller" under Human Interface Devices, you can try to reproduce it again.
I went through it again and this time I made sure that there were several "HID-compliant game controller" under "Human Interface Devices" and still couldn't reproduce the crash. I disabled the "Y" axis for each of the controllers and tried other combinations without any luck. - created a build on two Win 8.1 machines using changeset 32dddf30405a - created 6-7 controllers using "Configure vJoy" and restarted the machine - ensured that the controllers have been created under "Device Manager" (also checked "Monitor vJoy" and saw all the controllers running) - ran the fx build that was built from changeset 32dddf30405a and opened "Bof_SetAxis_Repro.html" (did this 15x on the two machines and always closed/re-opened fx) I'm not sure why this isn't reproducing for me, seems like I'm doing everything correctly. Really strange. Maybe someone else can try to see if they can reproduce this? Looks like Ted wasn't able to reproduce it either via comment #17.
(In reply to Kamil Jozwiak [:kjozwiak] from comment #24) > I went through it again and this time I made sure that there were several Thanks Kamil. Weird. I found this bug when debugging the fix of the previous bug (Bug 1011859), so the configuration is the same with the previous bug. Ted said the code/fix is multi-threading, it's consistent with my analysis that the problem is exposed in race condition. I reproduced it reliably in 2 stable releases with both local build and official build, so it's not specific to build settings. I also reproduced it reliably on two machines with different OS (win7 and win8), so it's not caused by special local condition.
We decided not to award a bounty for this one because this got fixed by a rewrite (bug 996078) specifically taken because we knew the old code was problematic, and because we were never able to reproduce the crash which causes us to doubt it is reliable enough to justify the sec-high rating.
Flags: sec-bounty? → sec-bounty-
Group: core-security
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: