Closed Bug 1072867 Opened 10 years ago Closed 9 years ago

IPC: attempting free on address which was not malloc()-ed [@mozilla::layers::MemoryTextureHost::DeallocateSharedData]

Categories

(Core :: Graphics: Layers, defect)

Product:
Core
Component:
Graphics: Layers
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED INCOMPLETE

People

(Reporter: posidron, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, sec-high, testcase)

Attachments

(1 file)

faulty-DeallocateSharedData-2.log
714.96 KB, text/plain
Details 
This happened while opening http://mozilla.github.io/webrtc-landing/pc_test.html in a build with '--enable-ipc-fuzzer' enabled.
Group: core-security
Keywords: crash, testcase
Blocks: fuzzing-ipc-ipdl
Attachment #8495154 - Attachment mime type: text/x-log → text/plain
Keywords: sec-high
Milan, is there somebody who can investigate this?  Thanks.
Flags: needinfo?(milan)
Group: gfx-core-security
Milan says he wouldn't expect it to be fixed in Fx39, too much stuff going on.
Been a while on this one - I'm assuming this is on OS X, and I'm assuming it still happens?  How intermittent is it?  Was the STR just to go to that page and click start and watch yourself on WebRTC?  I tried 4-5 times, can't reproduce on OS X 10.9.5, with the locally built debug+ipc-fuzzing.
Flags: needinfo?(milan) → needinfo?(cdiehl)
Yes those were the STR. It is probably not reproducible anymore. When time allows it, I will update the IPC fuzzer again and make some re-runs. I am sure after 6 month a lot of changes were made in the IPC infrastructure.
Flags: needinfo?(cdiehl)
This is an old fuzz bug that probably can't be reproduced.
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → INCOMPLETE
Group: core-security → core-security-release
Group: gfx-core-security, core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: