1034146 - [HwComposer] HwcDebug is causing buffer overwrites, crashes

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[Eric Rahm [:erahm]]

Attachment: hwcomposer_sprintf.patch

On my Flame, |HwcDebug::HwcDebug| performs a |strncpy| with an incorrect length which leads to a non-null terminated string. It then does a |sprintf| with this value leading to memory corruption.

DMD builds are crashing 100% of the time due to this, but it is certainly happening other builds as well. This affects 1.4+ at least.

Comment 1

[Eric Rahm [:erahm]]

Sushil can you take a look at this?

Comment 2

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Nominating for 1.4.  People are still testing/developing 1.4 on QC devices (e.g. Flame) so we need this there to have working tools.

Comment 3

[Sushil]

Fix for this issue has landed in HAL. Can you please test with the CAF patch:

https://www.codeaurora.org/cgit/quic/la/platform/hardware/qcom/display/commit/?h=b2g_kk_3.5&id=f0366091389b3f0648a92e6a7173237937bc0393

Comment 4

[Sushil]

Eric, can you test with above CAF patch and let me know?

Comment 6

[Eric Rahm [:erahm]]

(In reply to Sushil from comment #4)
> Eric, can you test with above CAF patch and let me know?

The patch does not apply to my local checkout, inspecting by hand does indicate that it contains approximately the same fix.

Comment 7

[Sushil]

Thanks.

Comment 8

[Wayne Chang [:wchang]]

Hi Vincent,

Can you check if this patch has any impact on non-caf projects?

Thanks

Comment 9

[Nicholas Nethercote [inactive]]

erahm gets a gold star for this one.

Comment 10

[Vincent Liu[:vliu]]

(In reply to Wayne Chang [:wchang] from comment #8)
> Hi Vincent,
> 
> Can you check if this patch has any impact on non-caf projects?
> 
> Thanks

Checked with two other non-caf jrojects and they didn't have HwcDebug::HwcDebug() code implementation.

Comment 11

[Wayne Chang [:wchang]]

Taking per comments to improve testing

Comment 12

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Hi Eric, I was wondering is this fixed for 1.4+?  Or do we need to push it to 2.0, 2.1?

Comment 13

[Eric Rahm [:erahm]]

We're still waiting for the fix to land upstream. See bug 1019634 comment 18.

Comment 14

[Michael Wu [:mwu]]

2.0: https://github.com/mozilla-b2g/b2g-manifest/commit/d2babab58743c696f46d614e84fdb9f2a0dd75d7

Comment 15

[Michael Wu [:mwu]]

1.4: https://github.com/mozilla-b2g/b2g-manifest/commit/ad87526f60b8411262813189d5d023c0c43a17eb