1300145 - Crash in InvalidArrayIndex_CRASH | mozilla::ContentCache::TextRectArray::GetUnionRectAsFarAsPossible

Status: RESOLVED FIXED

(Core :: Widget, defect)

Description

[Andrew McCreight [:mccr8]]

This bug was filed from the Socorro interface and is 
report bp-150bc69d-c899-4b95-81f5-4749e2160831.
=============================================================

This is happening on the line:
  rect = rect.Union(mRects[startOffset - mStart + i]);

These crashes have: ElementAt(aIndex = 4294967295, aLength = 0) where 4294967295 is 2^32-1, so we've underflowed.

Comment 1

[Makoto Kato [:m_kato]]

I think that this issue is bug 1291082.  Although uplift request is rejected, should we fix this?

Comment 2

[Daniel Veditz [:dveditz]]

Is this exploitable, or is it always going to crash?

Comment 3

[Makoto Kato [:m_kato]]

(In reply to Daniel Veditz [:dveditz] from comment #2)
> Is this exploitable, or is it always going to crash?

Crash only by invalid memory read.

Comment 4

[Andrew McCreight [:mccr8]]

(In reply to Daniel Veditz [:dveditz] from comment #2)
> Is this exploitable, or is it always going to crash?

It is always going to crash on Nightly and Aurora, but other branches are going to have out of bounds access.

Comment 5

[Makoto Kato [:m_kato]]

(In reply to Andrew McCreight [:mccr8] from comment #4)
> (In reply to Daniel Veditz [:dveditz] from comment #2)
> > Is this exploitable, or is it always going to crash?
> 
> It is always going to crash on Nightly and Aurora, but other branches are
> going to have out of bounds access.

I cannot find same signature on 51.0a1. :mccr8, do you have same crash signature on 51.0a1?

Comment 6

[Andrew McCreight [:mccr8]]

Yeah, I don't see any on 51 either.

Comment 7

[Andrew McCreight [:mccr8]]

So hopefully this was fixed by bug 1291082.

Comment 8

[Makoto Kato [:m_kato]]

Ritu, although you reject uplift request for bug 1291082, this is filed as sec-other bug.

Could you reconsider uplift approval for bug 1291082?.  If still rejected, we should close this as dup or wontfix.

Comment 9

[Daniel Veditz [:dveditz]]

Let's call this "fixed" "depends on"

Comment 10

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Thanks Dan!