1254925 - Graphite 2 vm::Machine::Code::estimateCodeDataOut underestimation leads to buffer overflow

Status: RESOLVED FIXED

(Core :: Graphics: Text, defect)

Description

[Holger Fuhrmannek]

Attachment: poc.zip

In pass.cpp the estimateCodeDataOut method is used to calculate the value of prog_pool_sz which is to small if the source data contains multiple very small code regions. 
poc tested with https://ftp.mozilla.org/pub/firefox/tinderbox-builds/mozilla-central-linux64-asan/1457494932/firefox-48.0a1.en-US.linux-x86_64-asan.tar.bz2

Comment 1

[Holger Fuhrmannek]

Attachment: asanlog.txt

Comment 2

[Tyson Smith [:tsmith]]

Verified this is reproducible on both Firefox nightly and the latest revision of graphite.

Comment 3

[martin_hosken]

Frustration. I can't replicate the failure. I have done a thorough visual review and I am hopeful that this may be fixed in e2a7bd658a6ea0614a6011db3507989c52d451e8. Please test for me. TIA.

Comment 4

[Tyson Smith [:tsmith]]

Verified with graphite revision e2a7bd658a6ea0614a6011db3507989c52d451e8

Comment 5

[Liz Henry (:lizzard) (relman/hg->git project)]

Jonathan, I think graphite is still preffed off by default in 46. Do we plan to change that back for 46? There's still this sec-critical bug and a few more that affect beta. We are heading into beta 9 so too late to uplift more graphite fixes.

Comment 6

[Jonathan Kew [:jfkthame]]

Yes, it's off-by-default for Release and Beta. I wasn't aiming to change this for 46 (and maybe not 47 either? -- let's see how the next few weeks go), so as to give us some breathing room to ensure things are stabilized and all relevant fixes safely landed.

Comment 7

[Tyson Smith [:tsmith]]

(In reply to Tyson Smith [:tsmith] from comment #4)
> Verified with graphite revision e2a7bd658a6ea0614a6011db3507989c52d451e8

Verified fixed to be clear.

Comment 8

[Liz Henry (:lizzard) (relman/hg->git project)]

Thanks, marking this wontfix for 46 then.

Comment 9

[Daniel Veditz [:dveditz]]

Graphite2 has been updated to 1.3.8 on all the relevant branches including ESRs