1180311 - null-dereference crash in nr_stun_get_addrs

Status: RESOLVED FIXED

(Core :: WebRTC: Networking, defect, P1)

Description

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

I just hit a null-dereference child process crash restoring my session:

(gdb) f 6
#6  0x00007f3552126891 in stun_getifaddrs (count=0x7f35356fa3a4,
    maxaddrs=<optimized out>, addrs=0x7f35356fa3a8)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/media/mtransport/third_pa
rty/nICEr/src/stun/addrs.c:262
262         switch (if_addr->ifa_addr->sa_family) {
(gdb) p if_addr
$1 = (struct ifaddrs *) 0x7f350c003fc8
(gdb) p if_addr->ifa_addr
$2 = (struct sockaddr *) 0x0

I'm using a Linux 64-bit debug build of https://hg.mozilla.org/mozilla-central/rev/2f25351c5b05 plus local patches.

Comment 1

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Attachment: gdb session

Comment 2

[Byron Campen [:bwc]]

On it.

Comment 3

[Byron Campen [:bwc]]

I would not say this is security, although the potential for user annoyance is very high for users with an unlucky network config.

Comment 4

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

I can repro reliably by loading http://www.vox.com/2015/6/15/8782235/san-francisco-housing-crisis which I pulled out of frame #11 on the stack.

Comment 5

[Byron Campen [:bwc]]

Huh. That page must be spinning up a PeerConnection by default. Wonder why.

Comment 6

[Byron Campen [:bwc]]

Fix incoming.

Comment 7

[Byron Campen [:bwc]]

Can you unset the sec flag so I can use reviewboard for this?

Comment 8

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

I can also repro reliably by loading:
http://www.nytimes.com/2015/06/16/world/europe/pope-francis-environmental-encyclical.html

I find it somewhat disturbing that all these pages are triggering this -- ads, maybe?


And I'm happy to unset the sec flag, although EKR set it, given that it's a null-deref.

Comment 9

[Byron Campen [:bwc]]

I'm a little concerned that these sites are creating PeerConnections, yes.

Comment 10

[Byron Campen [:bwc]]

Attachment: MozReview Request: Bug 1180311: Add null check to ifa_addr.

Bug 1180311: Add null check to ifa_addr.

Comment 11

[Eric Rescorla (:ekr)]

https://reviewboard.mozilla.org/r/12623/#review11085

LGTM

Comment 12

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

... and also http://arstechnica.com/gadgets/2014/10/how-mobile-payments-really-work/

(I'm repeatedly restoring the session and culling the tab that crashes.)

Comment 13

[Maire Reavy [:mreavy]]

Byron -- Is this a regression or is only Nightly (Fx42) affected?  Can you set the tracking info on this bug?  Thanks.

Comment 14

[Byron Campen [:bwc]]

Comment on attachment 8629507 [details]
MozReview Request: Bug 1180311: Add null check to ifa_addr.

Setting review flag (see comment 11).

This only affects nightly.

Try has some unrelated pre-existing failures.

Comment 15

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/2b835d207c96

Comment 16

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/2b835d207c96