1284499 - Hovering tab with long title causes graphical issues and crashes Cinnamon desktop.

Status: NEW

(Core :: Widget: Gtk, defect, P3)

Description

[william]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:47.0) Gecko/20100101 Firefox/47.0
Build ID: 20160609214634

Steps to reproduce:

Create a webpage with a title attribute of greater than ~1500 characters.  Mouse over the tab which usually displays the name of the page in a yellow box.

This was tested by editing the google homepage title to be a large number of consecutive 'a' characters.

It was run on Linux Mint 17.2 Rafaela and Cinnamon 2.6.13.  It affected both the nightly 50.0a1 Firefox build and the 47.a build.

I have marked this as security related as it seems like a buffer overflow, however I have not tested this idea.


Actual results:

With a low number of characters (~1500-2000) the yellow box will display massively distorted.
With a high numbers of characters (>2500) the Cinnamon desktop crashed.  At over 10000 characters the crash takes longer to recover from.


Expected results:

It should have displayed a yellow box with the website title.

Comment 1

[:Gijs (he/him)]

Do you have a crash dump from the desktop? This smells like a GTK issue to me, if the entire desktop goes down...

Comment 2

[william]

Attachment: xsession crash dump

Attached crash dump.

Comment 3

[:Gijs (he/him)]

Milan, seems Karl is away, any idea if this is graphics, XUL or GTK and/or who to ping in karl's absence?

Comment 4

[Milan Sreckovic [:milan] (needinfo for best results)]

Andrew, can you take a look?

Comment 5

[Andrew Comminos [:acomminos]]

I suspect that your GL implementation does not support textures the size of the tooltip window (as exposed by EXT_texture_from_pixmap), as suggested by

> (cinnamon:24735): Cogl-ERROR **: Failed to create texture 2d due to size/format constraints

which is causing your X11 compositor (cinnamon+clutter) to crash.

I'll look into ensuring that the tooltip is correctly clipped to the screen bounds- that seems like the sanest solution to this issue. If we can't create textures the size of the screen, the user will have other problems with accelerated X11 composition anyway.

Comment 6

[:Gijs (he/him)]

Does this need to stay sec-sensitive? (I don't think so, but I'm less familiar with the internals and risks here.)

Comment 7

[Andrew Comminos [:acomminos]]

It won't expose any user data, no (I'm assuming that's what sec-sensitive is for).

FWIW, I can't reproduce using gnome-shell with mesa 11.2.2 on a Haswell IGP. The tooltip (correctly) gets clipped to the screen extents.

Comment 8

[:Gijs (he/him)]

(In reply to Andrew Comminos [:acomminos] from comment #7)
> It won't expose any user data, no (I'm assuming that's what sec-sensitive is
> for).

No, it's security-sensitive because comment #0 assumed there was a security bug in Firefox that could potentially be exploited in this bug. If this is a 'safe' crash, it's a sec-low at most and we don't need to keep it hidden from the public.

Comment 9

[Andrew Comminos [:acomminos]]

Makes sense- let's consider it a 'safe' crash then.

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee didn't login in Bugzilla in the last 7 months, so the assignee is being reset.