Closed Bug 1304599 Opened 8 years ago Closed 8 years ago

Crash in InvalidArrayIndex_CRASH | nsTArray_Impl<T>::ElementAt | mozilla::widget::IMMHandler::DispatchCompositionChangeEvent

Categories

(Core :: Widget: Win32, defect)

Product:
Core
Component:
Widget: Win32
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1300140

People

(Reporter: n.nethercote, Unassigned)

Details

(Keywords: crash, sec-other) 

This bug was filed from the Socorro interface and is 
report bp-47b1a265-be42-4075-82ac-062cd2160922.
=============================================================

A nsTArray bounds check failure crash. 9 occurrences across 5 installations in the past week. All in Firefox 50.0a2 which is the version in which the bounds checking was added.

In every case the array had length one and we read one past the end.

jimm, can you please take a look?
Flags: needinfo?(jmathies)
This is likely a dupe of bug 1300140 or 1300143.
Group: core-security
Flags: needinfo?(jmathies)
Keywords: sec-other
Err, I mean, bug 1300140.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → DUPLICATE
Crash Signature: [@ InvalidArrayIndex_CRASH | nsTArray_Impl<T>::ElementAt | mozilla::widget::IMMHandler::DispatchCompositionChangeEvent] → [@ InvalidArrayIndex_CRASH | nsTArray_Impl<T>::ElementAt | mozilla::widget::IMMHandler::DispatchCompositionChangeEvent] [@ InvalidArrayIndex_CRASH | nsTArray_Impl<T>::ElementAt | mozilla::widget::IMMHandler::HandleComposition]
Crash Signature: [@ InvalidArrayIndex_CRASH | nsTArray_Impl<T>::ElementAt | mozilla::widget::IMMHandler::DispatchCompositionChangeEvent] [@ InvalidArrayIndex_CRASH | nsTArray_Impl<T>::ElementAt | mozilla::widget::IMMHandler::HandleComposition]
Group: core-security
You need to log in before you can comment on or make changes to this bug.