Assertion: IntRect(IntPoint(), GetSize()).IsEqualEdges(aFrameRect) [@mozilla::image::nsPNGDecoder::CheckForTransparency]

RESOLVED WORKSFORME

Status

()

defect
RESOLVED WORKSFORME
4 years ago
4 years ago

People

(Reporter: tsmith, Unassigned)

Tracking

({assertion, testcase})

Trunk
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox44 affected)

Details

Attachments

(2 attachments)

Reporter

Description

4 years ago
Posted file call_stack.txt
Found while fuzzing. Not sure if this is a sec issue feel free to open it if it not.

Assertion failure: IntRect(IntPoint(), GetSize()).IsEqualEdges(aFrameRect), at /builds/slave/m-cen-l64-asan-d-0000000000000/build/src/image/decoders/nsPNGDecoder.cpp:155
Reporter

Comment 1

4 years ago
Posted image test_case.png
Haven't debugged this, but bug 1060609 seems like the most likely culprit just based on the location of the assertion.
Blocks: 1060609
Can you figure out if this is a security issue at least, Seth? Thanks.
Flags: needinfo?(seth)
Tyson, can you test this to see if it still reproduces?
Flags: needinfo?(seth) → needinfo?(twsmith)
Reporter

Comment 5

4 years ago
Looks like this is no longer reproducible.
Status: NEW → RESOLVED
Closed: 4 years ago
Flags: needinfo?(twsmith)
Resolution: --- → WORKSFORME
Group: gfx-core-security
You need to log in before you can comment on or make changes to this bug.