1153090 - Unaligned access in cert block list

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[Martin Husemann]

Attachment: Do not cast and dereference an arbitrary byte pointer, use memcpy instead

Obvious bug on alignment critical architectures

Comment 1

[Landry Breuil (:gaston)]

Comment on attachment 8590636 [details] [diff] [review]
Do not cast and dereference an arbitrary byte pointer, use memcpy instead

Deferring to mgoodwin who added this in bug 1024809

Comment 2

[Mark Goodwin [:mgoodwin]]

Comment on attachment 8590636 [details] [diff] [review]
Do not cast and dereference an arbitrary byte pointer, use memcpy instead

Review of attachment 8590636 [details] [diff] [review]:
-----------------------------------------------------------------

Hi, many thanks for your help on this.

The change itself looks good to me (it's always great to get a patch with a bug report) but there are a couple of things that I should point out:

Firstly, it's important that a patch is formatted correctly. See this document for more information: https://developer.mozilla.org/en-US/docs/Mercurial_FAQ#How_can_I_generate_a_patch_for_somebody_else_to_check-in_for_me.3F
more general guidance is available here: https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/How_to_Submit_a_Patch

Secondly, we usually make sure that patches are made against mozilla-central, then uplifted to other branches as necessary. Your patch, reformatted, works fine for versions earlier than 40 (so we can use that for uplift) but we'll need a separate patch for central too.

I'll sort these things out for you this time; if you contribute again, It'd be great if you could follow the guidelines I've linked to above.

Thanks again.

Comment 3

[Mark Goodwin [:mgoodwin]]

Attachment: Bug1153090.patch

Comment 4

[Landry Breuil (:gaston)]

Martin is still learning the ropes on how to properly upstream patches - i went through this in the past so i'm trying to help :)

As mark said, using an hg clone of mozilla-central, working against trunk and producing hg patches (with MQ, so far..) with a properly formatted commit message helps a lot for getting a patch directly commited, instead of having the reviewer reformat it for you. It may feel tedious, but once you get used to it that works :)

Comment 5

[Mark Goodwin [:mgoodwin]]

Attachment: Bug1153090_uplift.patch

Patch for uplift (prepared against aurora)

Comment 6

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8592144 [details] [diff] [review]
Bug1153090_uplift.patch

Review of attachment 8592144 [details] [diff] [review]:
-----------------------------------------------------------------

Actually, it occurs to me that we should maybe be using sizeof(hash) instead of hard-coded '4'. r=me with that changed on this and the other patch.

Comment 7

[Landry Breuil (:gaston)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/bb16a021fcef

Comment 8

[Landry Breuil (:gaston)]

Comment on attachment 8592144 [details] [diff] [review]
Bug1153090_uplift.patch

Uplift to aurora and beta so that it makes ESR ?

Approval Request Comment
[Feature/regressing bug #]: 1024809
[User impact if declined]: unaligned access on alignment critical archs (NPOTB)
[Describe test coverage new/current, TreeHerder]: https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=ac8f93de22cb
[Risks and why]: none
[String/UUID change made/needed]: none

Comment 9

[Landry Breuil (:gaston)]

Oops, sorry martin i sort of stole your authorship when importing your patch :(

Comment 10

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

(In reply to Landry Breuil (:gaston) from comment #7)
> https://hg.mozilla.org/integration/mozilla-inbound/rev/bb16a021fcef

I guess I wasn't clear - I meant replace all hard-coded '4's in that function with sizeof(hash) (or have a temporary variable). Updating the comment to say 'the size of the hash key' instead of 32 bits might also be good.

Comment 11

[Landry Breuil (:gaston)]

Attachment: bug-1153090-fwup

Oops, my bad.. so, something like this, reformatted to fit in 80 chars ?

Comment 12

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8592409 [details] [diff] [review]
bug-1153090-fwup

Review of attachment 8592409 [details] [diff] [review]:
-----------------------------------------------------------------

Sure - another option would be to use a temporary variable to cut down on the number of parentheses, but I think this is fine.

Comment 13

[Landry Breuil (:gaston)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ff2912e36af0

Comment 14

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/bb16a021fcef
https://hg.mozilla.org/mozilla-central/rev/ff2912e36af0

Comment 15

[Sylvestre Ledru [:Sylvestre]]

Comment on attachment 8592144 [details] [diff] [review]
Bug1153090_uplift.patch

Should be in 38 beta 5.

> [Risks and why]: none
All patches have risks. Please provide some evaluation next time!

Comment 16

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/51ef02cbd50b

Comment 17

[Ryan VanderMeulen [:RyanVM]]

This time with 100% less silly uplift bustage.
https://hg.mozilla.org/releases/mozilla-aurora/rev/27d913eaef22

Comment 18

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/58f203b17be2