Closed
Bug 1177667
Opened 11 years ago
Closed 11 years ago
Heap Address Leak
Categories
(Core :: XML, defect)
Tracking
()
RESOLVED
INVALID
People
(Reporter: ugobejishvili, Unassigned)
Details
(Keywords: csectype-disclosure, sec-moderate)
User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/37.0.2062.120 Chrome/37.0.2062.120 Safari/537.36
Firefox for Android
Steps to reproduce:
File 1: testcase.xml
<?xml-stylesheet type="text/xsl" href="testcase.xsl"?>
<catalog>
<cd>
</cd>
</catalog>
File 2: testcase.xsl
<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template match="/">
<html>
<body>
<table border="1">
<xsl:for-each select="catalog/cd">
<xsl:value-of select="generate-id()"/>
</xsl:for-each>
</table>
</body>
</html>
</xsl:template>
</xsl:stylesheet>
Locate both files to the same directory and visit testcase.xml.
Actual results:
Heap address shows up
|
Reporter | |
Updated•11 years ago
|
OS: Unspecified → All
Hardware: Unspecified → All
|
||
Updated•11 years ago
|
Component: Untriaged → XML
Product: Firefox → Core
|
||
Comment 1•11 years ago
|
||
Please don't tell me that our implementation of generate-id() just returns the object's address.
|
||
Comment 2•11 years ago
|
||
txXPathNodeUtils::getXSLTId does:
551 uintptr_t nodeid = ((uintptr_t)aNode.mNode) - ((uintptr_t)aBase.mNode);
So if aBase.mNode is null, you do just get aNode.mNode. Not sure whether aBase.mNode can be null here.
Flags: needinfo?(peterv)
Flags: needinfo?(jonas)
|
||
Comment 3•11 years ago
|
||
(In reply to Boris Zbarsky [:bz] from comment #2)
> txXPathNodeUtils::getXSLTId does:
>
> 551 uintptr_t nodeid = ((uintptr_t)aNode.mNode) -
> ((uintptr_t)aBase.mNode);
>
> So if aBase.mNode is null, you do just get aNode.mNode. Not sure whether
> aBase.mNode can be null here.
Debugging lldb I'm not seeing aBase as null:
Process 43617 stopped
* thread #1: tid = 0xfa2f64, 0x0000000103b13d6e XUL`txXPathNodeUtils::getXSLTId(aNode=0x000000011e39dcc0, aBase=0x000000011e2fb230, aResult=0x000000011e2ff298) + 30 at txMozillaXPathTreeWalker.cpp:551, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1
frame #0: 0x0000000103b13d6e XUL`txXPathNodeUtils::getXSLTId(aNode=0x000000011e39dcc0, aBase=0x000000011e2fb230, aResult=0x000000011e2ff298) + 30 at txMozillaXPathTreeWalker.cpp:551
548 const txXPathNode& aBase,
549 nsAString& aResult)
550 {
-> 551 uintptr_t nodeid = ((uintptr_t)aNode.mNode) - ((uintptr_t)aBase.mNode);
552 if (!aNode.isAttribute()) {
553 CopyASCIItoUTF16(nsPrintfCString(gPrintfFmt, nodeid),
554 aResult);
(lldb) p aNode
(const txXPathNode) $0 = {
mNode = 0x000000011e39b860
mRefCountRoot = 0
mIndex = 1073741823
}
(lldb) p aBase
(const txXPathNode) $1 = {
mNode = 0x000000011dfd2000
mRefCountRoot = 0
mIndex = 1073741824
}
The id printed is:
id0x3c9860
Which is indeed aNode - aBase.
This looks INVALID to me.
Flags: needinfo?(jonas)
|
||
Comment 5•11 years ago
|
||
I don't think aBase.mNode can be null. Callers of txXPathNodeUtils::getXSLTId pass in txExecutionState::getSourceDocument(). txExecutionState::getSourceDocument returns txLoadedDocumentsHash::mSourceDocument, which is set in txLoadedDocumentsHash::init. txLoadedDocumentsHash::init does |txXPathNodeUtils::getBaseURI(*mSourceDocument, baseURI);|, which ends up doing |aNode.mNode->GetBaseURI(aURI);| with aNode == mSourceDocument. If mSourceDocument.mNode is null then we'd have crashed with a null deref much earlier.
Looks INVALID to me too.
Flags: needinfo?(peterv)
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → INVALID
|
||
Updated•10 years ago
|
Group: core-security → core-security-release
|
|
||
Updated•10 years ago
|
Group: core-security-release
You need to log in
before you can comment on or make changes to this bug.
Description
•