Closed Bug 1235469 Opened 8 years ago Closed 7 years ago

Heap-buffer-overflow [@ gldBlitFramebufferData] with canvas, shadow, drawImage(HTMLVideoElement)

Categories

(Core :: Graphics, defect)

Unspecified
macOS
defect
Not set
critical

Tracking

()

RESOLVED INCOMPLETE

People

(Reporter: jruderman, Assigned: pchang)

References

Details

(Keywords: crash, sec-high, testcase, Whiteboard: [gfx-noted])

Attachments

(5 files)

Same testcase as bug 1225250, crashes again on mozilla-central, at least with ASan. I haven't gotten non-ASan builds to crash with this testcase.

You'll need to adjust the testcase so it points to your copy of layout/reftests/webm-video/frames.webm (in your mozilla-central tree or tests zip). Any other video file will probably crash too, but an image file won't.
Attached file ASan stacks
Assignee: nobody → lsalzman
I tried to reproduce this on Linux with accelerated Skia on an ASan build, but I was not able to get it to reproduce at all.

I'm CC'ing this over to Mason to see if he wants to test it on OS X and can get it to reproduce for him.
Assignee: lsalzman → nobody
OS: Unspecified → Mac OS X
Whiteboard: [gfx-noted]
From https://developer.mozilla.org/en-US/docs/Mozilla/Testing/Firefox_and_Address_Sanitizer, it looks like mac ASAN builds aren't really supported at the moment, and only linux builds are. There are some instructions on how to build ASAN on OS X here - https://bugzilla.mozilla.org/show_bug.cgi?id=1026162#c7. How are you building ASAN builds?
Flags: needinfo?(jruderman)
Keywords: sec-high
Mason,

The fuzzing team builds Mac ASAN every day. 

AFAIK, https://developer.mozilla.org/en-US/docs/Mozilla/Testing/Firefox_and_Address_Sanitizer#Adjusting_the_build_configuration is the instruction set. 

CC'ing Decoder.
Attached file Compile error log
I'm getting a lot of linker errors with an ASAN build from following the instructions at https://developer.mozilla.org/en-US/docs/Mozilla/Testing/Firefox_and_Address_Sanitizer#Adjusting_the_build_configuration. I also compiled my own LLVM / Clang to get the llvm-symbolizer working and that didn't seem to fix the compile error.
Traditionally, ASAN compilation has been very sensitive to clang revisions. What version of LLVM are you using?
(In reply to Mason Chang [:mchang] from comment #5)
> Created attachment 8720590 [details]
> Compile error log
> 
> I'm getting a lot of linker errors with an ASAN build from following the
> instructions at
> https://developer.mozilla.org/en-US/docs/Mozilla/Testing/
> Firefox_and_Address_Sanitizer#Adjusting_the_build_configuration. I also
> compiled my own LLVM / Clang to get the llvm-symbolizer working and that
> didn't seem to fix the compile error.

I've tried both with clang that comes with OS X El Capitan:

clang --version
Apple LLVM version 7.0.2 (clang-700.1.81)
Target: x86_64-apple-darwin15.3.0
Thread model: posix

And locally built:
./clang --version
clang version 3.7.1 (tags/RELEASE_371/final)
Target: x86_64-apple-darwin15.3.0
Thread model: posix
At https://developer.mozilla.org/en-US/docs/Mozilla/Testing/Firefox_and_Address_Sanitizer it suggests:

REV=200213

with a big bold note that says:

It is NOT advised to use system-supplied versions of clang for ASAN builds; they may have issues or instabilities when used to build/test Firefox.  The versions given are known to work.
Some new different errors even using the specific clang version:

 # For MacOSX, please use at least r214699.

I also downloaded the 10.8 SDK since I'm on 10.11, same error.
Peter, can somebody in Taipei do the ASAN build?
Flags: needinfo?(howareyou322)
(In reply to Milan Sreckovic [:milan] from comment #11)
> Peter, can somebody in Taipei do the ASAN build?

I can try to build ASAN build on OSX first.
(In reply to Jesse Ruderman from comment #0)
> Created attachment 8702419 [details]
> testcase (may crash Firefox) (requires path adjustment)
> 
> Same testcase as bug 1225250, crashes again on mozilla-central, at least
> with ASan. I haven't gotten non-ASan builds to crash with this testcase.
> 
> You'll need to adjust the testcase so it points to your copy of
> layout/reftests/webm-video/frames.webm (in your mozilla-central tree or
> tests zip). Any other video file will probably crash too, but an image file
> won't.

I just built the ASAN build on OSX but I couldn't reproduce this issue after modifying video path. 
Jesse, are you able to reproduce this issue?
Flags: needinfo?(howareyou322)
Assigning while Peter is looking into this.
Assignee: nobody → howareyou322
Jesse, as comment in 13, are you able to reproduce this issue now?
Schwartzentruber, can you look at this?
Flags: needinfo?(jruderman) → needinfo?(jschwartzentruber)
I'm also unable to reproduce, but... the crash is in the Geforce driver, which I don't have.
Flags: needinfo?(jschwartzentruber)
No way forward and there isn't further information to reproduce this. Closing as incomplete. If someone finds a way to reproduce it, please re-open.
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → INCOMPLETE
Group: gfx-core-security
You need to log in before you can comment on or make changes to this bug.