1157247 - crash in sfk.dll@0x108b

Status: RESOLVED WONTFIX

(Firefox :: General, defect)

Description

[Robert Kaiser]

This bug was filed from the Socorro interface and is 
report bp-9c77ed73-6620-4a06-b0ea-f720e2150422.
=============================================================

This is a pretty new crash, we had two crashes on 2015-04-17 around 8:50 UTC from a single Firefox 37.0.1 installation and then it started to spread widely starting at 2015-04-20 08:38 UTC.

Stack frames:
0 	sfk.dll 	sfk.dll@0x108b 	
Ø 1 	sfk.dll 	sfk.dll@0x3d4f 	
Ø 2 	sfk.dll 	sfk.dll@0x2f41 	
Ø 3 	sfk.dll 	sfk.dll@0x2d3fd 	
Ø 4 	sfk.dll 	sfk.dll@0x2d724 	
5 	nss3.dll 	SocketSend 	nsprpub/pr/src/io/prsocket.c
6 	nss3.dll 	SocketWrite 	nsprpub/pr/src/io/prsocket.c
7 	nss3.dll 	PR_Write 	nsprpub/pr/src/io/priometh.c
8 	xul.dll 	nsSocketOutputStream::Write(char const*, unsigned int, unsigned int*) 	netwerk/base/src/nsSocketTransport2.cpp
9 	xul.dll 	mozilla::net::nsHttpConnection::OnReadSegment(char const*, unsigned int, unsigned int*) 	netwerk/protocol/http/nsHttpConnection.cpp
10 	xul.dll 	mozilla::net::nsHttpTransaction::ReadRequestSegment(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*) 	netwerk/protocol/http/nsHttpTransaction.cpp
11 	xul.dll 	nsBufferedInputStream::ReadSegments(tag_nsresult (*)(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*), void*, unsigned int, unsigned int*) 	netwerk/base/src/nsBufferedStreams.cpp
12 	xul.dll 	mozilla::net::nsHttpTransaction::ReadSegments(mozilla::net::nsAHttpSegmentReader*, unsigned int, unsigned int*) 	netwerk/protocol/http/nsHttpTransaction.cpp
13 	xul.dll 	mozilla::net::nsHttpConnection::OnSocketWritable() 	netwerk/protocol/http/nsHttpConnection.cpp


Correlations unsurprisingly find this:
100% (718/718) vs. 0% (727/151544)	SFK.dll

The module has no version:

Filename 	Version 	Debug Identifier 	Debug Filename
Ø SFK.dll 		359097E309F94730B33019DFE7BA601Cb 	SFK.pdb


There are no really good add-ons correlations, though there's 14& vs. 1% for both [e-mail] and [e-mail] as well as 6% vs. 1% for [e-mail]

Searches for sfk.dll don't really point out anything that it could be.


I guess that this is probably some kind of malware, given it has no version. It probably hooks into a network connection, maybe for displaying/injecting some ads or similar.

Comment 1

[Robert Kaiser]

FWIW, we had somewhat over 7000 crashes (stats say 700-something but they only count 10% of our crashes) on 37 releases on every of the last two days.

Comment 2

[Lawrence Mandel [:lmandel] (use needinfo)]

I also didn't find any information about sfk.dll that looked useful. What options do we have with this? Can we block the dll?

Comment 3

[Lawrence Mandel [:lmandel] (use needinfo)]

Firefox 37 will be EOL on Tuesday. As such, I have set the status for this release as wontfix. I see a low incidence of this crash signature in 38 Beta data, no crashes in 39 Aurora, and very few in 40 Nightly. Let's see what happens with this bug once 38 hits release.

Comment 4

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.