<a class="header-button" href="https://bugzilla.mozilla.org/home" title="Go to home page"> Bugzilla

Assignee

Comment 1

•

8 years ago

I think this is because nsDisplayFocusRing uses display item type TYPE_OUTLINE, which is also used by nsDisplayOutline. Each display item needs it's own type. This was added in https://hg.mozilla.org/mozilla-central/rev/bb2b0d8fdfd3 from bug 864120, so it was probably just overlooked when implementing the new display item type.

Blocks: 864120

Assignee

Comment 2

•

8 years ago

Attached patch patch — Details — Splinter Review

Assignee: nobody → tnikkel

Assignee

Updated

•

8 years ago

Attachment #8785020 - Flags: review?(matt.woodrow)

Andrew McCreight [:mccr8]

Assignee

Comment 3

•

8 years ago

I haven't tested that the patch fixes the problem, but I'm guessing it will.

Updated

•

8 years ago

status-firefox48: --- → wontfix

status-firefox49: --- → affected

status-firefox50: --- → affected

status-firefox-esr45: --- → affected

Matt Woodrow (:mattwoodrow)

Assignee

Comment 4

•

8 years ago

Getting something automated that checks the invariant that every different display item class gets a different display item type would be good.

Updated

•

8 years ago

Attachment #8785020 - Flags: review?(matt.woodrow) → review+

Assignee

Comment 5

•

8 years ago

Comment on attachment 8785020 [details] [diff] [review] patch [Security approval request comment] How easily could an exploit be constructed based on the patch? see below Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem? the patch points to <input type="range"> as the source of the issue, knowing that it might not be too hard to run a fuzzer with ASAN builds to find this heap overflow Which older supported branches are affected by this flaw? all of them If not all supported branches, which bug introduced the flaw? bug 864120 Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be? trivial How likely is this patch to cause regressions; how much testing does it need? very unlikely, no extra testing required

Attachment #8785020 - Flags: sec-approval?

Comment 6

•

8 years ago

sec-approval+ for trunk. Please nominate aurora, beta, and ESR45 patches as we're running out of time. Release Management, this is a TWO line change so it should be pretty safe everywhere.

tracking-firefox49: --- → +

tracking-firefox50: --- → +

tracking-firefox51: --- → +

tracking-firefox-esr45: --- → 49+

Updated

•

8 years ago

Attachment #8785020 - Flags: sec-approval? → sec-approval+

https://hg.mozilla.org/integration/mozilla-inbound/rev/ff8a0cac29b2dc7634531b03133f97e1c1460818

Assignee

Comment 7

•

8 years ago

Liz Henry (:lizzard) (relman/hg->git project)

Assignee

Comment 8

•

8 years ago

Comment on attachment 8785020 [details] [diff] [review] patch [Approval Request Comment] If this is not a sec:{high,crit} bug, please state case for ESR consideration: hasn't been rated yet, but heap overflows are usually sec-crit User impact if declined: security issue Fix Landed on Version: 51 Risk to taking this patch (and alternatives if risky): safe String or UUID changes made by this patch: none See https://wiki.mozilla.org/Release_Management/ESR_Landing_Process for more info. Approval Request Comment [Feature/regressing bug #]: bug 864120 [User impact if declined]: security issue [Describe test coverage new/current, TreeHerder]: none [Risks and why]: safe [String/UUID change made/needed]: none

Attachment #8785020 - Flags: approval-mozilla-esr45?

Attachment #8785020 - Flags: approval-mozilla-beta?

Attachment #8785020 - Flags: approval-mozilla-aurora?

Comment 9

•

8 years ago

No security rating here. Dan can you help out? tnikkel can you request sec-approval, assuming this may turn out to be sec-critical? We will likely go to build Monday morning, so if this misses beta 8 we can still consider it for beta 9 later in the week.

Flags: needinfo?(tnikkel)

Flags: needinfo?(dveditz)

Assignee

Comment 10

•

8 years ago

(In reply to Liz Henry (:lizzard) (needinfo? me) from comment #9) > tnikkel can you request sec-approval, assuming this may turn out to be > sec-critical? sec-approval has already been requested and granted, see comment 6.

Flags: needinfo?(tnikkel)

Liz Henry (:lizzard) (relman/hg->git project)

Assignee

Comment 11

•

8 years ago

Would you mind confirming that the patch fixed the issue for you?

Flags: needinfo?(inferno)

Abhishek Arya

Reporter

Comment 12

•

8 years ago

(In reply to Timothy Nikkel (:tnikkel) from comment #11) > Would you mind confirming that the patch fixed the issue for you? Verified that the patch fixes the bad cast.

Flags: needinfo?(inferno)

Comment 13

•

8 years ago

I missed that. Thanks.

Liz Henry (:lizzard) (relman/hg->git project)

Comment 14

•

8 years ago

Comment on attachment 8785020 [details] [diff] [review] patch Likely sec-critical, fix verified in comment 12, let's uplift this for the beta 8 build.

Attachment #8785020 - Flags: approval-mozilla-beta?

Attachment #8785020 - Flags: approval-mozilla-beta+

Attachment #8785020 - Flags: approval-mozilla-aurora?

Attachment #8785020 - Flags: approval-mozilla-aurora+

Sylvestre Ledru [:Sylvestre]

Updated

•

8 years ago

Keywords: sec-critical

Sylvestre Ledru [:Sylvestre]

Comment 15

•

8 years ago

Comment on attachment 8785020 [details] [diff] [review] patch Taking to esr45 too.

Attachment #8785020 - Flags: approval-mozilla-esr45? → approval-mozilla-esr45+

Ryan VanderMeulen [:RyanVM]

Comment 16

•

8 years ago

https://hg.mozilla.org/mozilla-central/rev/ff8a0cac29b2

Status: NEW → RESOLVED

Closed: 8 years ago

status-firefox51: affected → fixed

Flags: needinfo?(dveditz) → in-testsuite?

Resolution: --- → FIXED

Target Milestone: --- → mozilla51

Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)

Comment 17

•

8 years ago

https://hg.mozilla.org/releases/mozilla-aurora/rev/350ef810694c https://hg.mozilla.org/releases/mozilla-beta/rev/748b8f8c0c98 https://hg.mozilla.org/releases/mozilla-esr45/rev/6e43a01fee3c

status-firefox49: affected → fixed

status-firefox50: affected → fixed

status-firefox-esr45: affected → fixed

Updated

•

8 years ago

Flags: sec-bounty?

Updated

•

8 years ago

Group: core-security → core-security-release

Andrei Vaida [:avaida]

Updated

•

8 years ago

Flags: qe-verify+

Updated

•

8 years ago

Whiteboard: [adv-main49+][adv-esr45.4+]

Comment 18

•

8 years ago

Reproduced on 50.0a1 (2016-06-15) asan build, Ubuntu 14.04. Verified fixed FX 49.0, 50.0a2 (2016-09-07), 45.4.0 ESR asan builds. Any idea why there are no recent asan builds on http://archive.mozilla.org/pub/firefox/tinderbox-builds/mozilla-central-linux64-asan/ ?

status-firefox49: fixed → verified

status-firefox50: fixed → verified

status-firefox-esr45: fixed → verified

Flags: needinfo?(tnikkel)

Assignee

Comment 19

•

8 years ago

(In reply to Paul Silaghi, QA [:pauly] from comment #18) > Any idea why there are no recent asan builds on > http://archive.mozilla.org/pub/firefox/tinderbox-builds/mozilla-central- > linux64-asan/ ? That's a question for someone else, but I'm not sure who would know.

Flags: needinfo?(tnikkel)

Comment 20

•

8 years ago

(In reply to Paul Silaghi, QA [:pauly] from comment #18) > Any idea why there are no recent asan builds on > http://archive.mozilla.org/pub/firefox/tinderbox-builds/mozilla-central- > linux64-asan/ ? Those builds aren't made by Tinderbox anymore. They moved to Task Cluster by release engineering (don't ask me why). My team documented how to get current builds: Manual browsing: 1. Go to https://tools.taskcluster.net/index/artifacts/#gecko.v2.mozilla-central.latest.firefox/gecko.v2.mozilla-central.latest.firefox.linux64-asan-opt 2. On the right side, you will see the most recent build (the browser is in "public/build/target.tar.bz2"). Automated downloading: There is a JSON API for accessing the index and the artifacts of a task, so you would have to: 1. Fetch https://index.taskcluster.net/v1/task/gecko.v2.mozilla-central.latest.firefox.linux64-asan-opt 2. Extract the taskId from the response. 3. Fetch https://queue.taskcluster.net/v1/task/<TASKID>/artifacts (replace <TASKID> with the id from the previous response). 4. Extract list of desired files and fetch them by appending them to the previous URL, e.g. the browser will be at: https://queue.taskcluster.net/v1/task/<TASKID>/artifacts/public/build/target.tar.bz2

Comment hidden (obsolete)

Updated

•

8 years ago

Alias: CVE-2016-5272

Comment 22

•

8 years ago

Thanks for clarifying. Verified fixed FX 51.0a1 (2016-09-08) asan, Ubuntu 14.04.

Status: RESOLVED → VERIFIED

status-firefox51: fixed → verified

Daniel Holbert [:dholbert]

Comment 23

•

8 years ago

(In reply to Daniel Holbert [:dholbert] from comment #21) > From talking to catlee, I think the answer is: > https://tools.taskcluster.net/index/#gecko.v2.mozilla-central.pushdate/ > gecko.v2.mozilla-central.pushdate How do I download a build from there? Let's say: https://tools.taskcluster.net/index/#gecko.v2.mozilla-central.pushdate.2016.09.01.20160901001112.firefox/gecko.v2.mozilla-central.pushdate.2016.09.01.20160901001112.firefox.linux64-asan-opt

Flags: needinfo?(dholbert)

Comment 24

•

8 years ago

Currently you'd need to jump through 3 more hoops from that page (yes, this sucks): - Click the "TaskId" link - Click "Run 0" - Under "Artifacts", click "public/build/target.tar.bz2" That'll give you the firefox build. (catlee says that these extra hoops are arguably a bug in taskcluster, and I've brought it up in #taskcluster. Hopefully the URL from comment 23 will just have an easy link to the build, at some point in the future.)

Flags: needinfo?(dholbert)

Daniel Holbert [:dholbert]

Comment 25

•

8 years ago

OK, better steps: use the "artifact" view on taskcluster, which has a similar folder structure to my link in comment 21, but actually shows you download links on the right. You can start navigating (by year, month, etc) from here: https://tools.taskcluster.net/index/artifacts/#gecko.v2.mozilla-central.pushdate/gecko.v2.mozilla-central.pushdate ...and you'll end up at a page like this: https://tools.taskcluster.net/index/artifacts/#gecko.v2.mozilla-central.pushdate.2016.09.01.20160901001112.firefox/gecko.v2.mozilla-central.pushdate.2016.09.01.20160901001112.firefox.linux64-asan-opt ...and target.tar.bz2 (linked on the right) is the file you're looking for.

Christian Holler (:decoder)

Comment 26

•

8 years ago

If you are just looking for the latest build, there is an easy way. Just use this direct URL for downloading: https://index.taskcluster.net/v1/task/gecko.v2.mozilla-central.latest.firefox.linux64-asan-opt/artifacts/public/build/target.tar.bz2

Daniel Holbert [:dholbert]

Comment 27

•

8 years ago

(Yup, abillings already gave a version of that link, in comment 20.)

Comment 28

•

8 years ago

Thank you for your explanations!

Updated

•

8 years ago

Flags: sec-bounty? → sec-bounty+

Keywords: sec-critical → csectype-other, regression, sec-high