1233651 - AddressSanitizer: heap-buffer-overflow in mozilla::image::Deinterlacer::PropagatePassToDownscaler(mozilla::image::Downscaler&)

Status: RESOLVED DUPLICATE of bug 1229825

(Core :: Graphics: ImageLib, defect)

Description

[Carsten Book [:Tomcat]]

Attachment: bughunter asan stack

No idea if we run into the problems from Bug #1223465 again - but it seems we get now similar crashes - or this is maybe bug 1231121 - no idea 

Bughunter reports:

memcpy mozilla::image::Deinterlacer::PropagatePassToDownscaler(mozilla::image::Downscaler&) mozilla::image::nsGIFDecoder2::OutputRow() mozilla::image::nsGIFDecoder2::DoLzw(unsigned char const*) mozilla::image::nsGIFDecoder2::WriteInternal(char const*, unsigned int)

and 

AddressSanitizer: heap-buffer-overflow on address 0x at pc 0x bp 0x sp 0x

on sites like: 
http://www.shortlist.com/entertainment/sport/the-10-new-stadiums-we-cant-wait-to-see-in-2016#gallery-1

bughunter reports this from beta -> trunk and was reproducible on a windows 7 trunk debug build based on current m-c tip

Comment 1

[Carsten Book [:Tomcat]]

Attachment: windbg information

windbg information from this site - however might be something like bug 1224185 that had also a js stack and turned out image related

Comment 2

[Ryan VanderMeulen [:RyanVM]]

I was able to reproduce both crashes and intermittent image corruption on the URL given. Similar to the other recent DDD crashes filed, it sometimes requires a few force-reloads to crash.

Regression range: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=bd4a6ddd01a049ebf846a0e4b5a795596e65508e&tochange=649f934c48e639a9d52e8da665b06a733f2e590d

Regression from bug 1207378.

Comment 3

[Julian Seward [:jseward]]

Attachment: Valgrind complaints and eventual crash

Similar to other Downscalar crashes we have seen, first 
there is a heap overrun in PropagatePassToDownscaler, followed
by crashery in JS-land, presumably because the heap has
been trashed.

Comment 4

[Julian Seward [:jseward]]

Would it be possible/feasible to get this downscaler fuzzed?

Comment 5

[Liz Henry (:lizzard)]

Tracking, but this is unlikely to be fixed in 43.

Comment 6

[Andrew McCreight [:mccr8]]

This is an invalid write based on the Valgrind logs, so I'm going to mark it sec-critical.

Comment 7

[Tyson Smith [:tsmith]]

This looks like a dup of bug 1229825

Comment 9

[Liz Henry (:lizzard)]

Marking wontfix since we wontfixed bug 1229825.

Comment 10

[Liz Henry (:lizzard)]

Also marking fixed for 44-46 from the flags in bug 1229825.