Closed Bug 1317879 Opened 9 years ago Closed 9 years ago

ASAN: heap-use-after-free in Get @ PLDHashTable.h:228 (DOMIntersectionObserver)

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1317415
Tracking Flags:
Tracking Status
firefox-esr45 --- unaffected
firefox52 --- affected
firefox53 --- affected

People

(Reporter: geeknik, Unassigned)

References

(
URL
)

Details

(4 keywords)

Fuzzing Nightly (ASAN Build ID 20161115140229) with lcamtuf's transition fuzz. ==7719==ERROR: AddressSanitizer: heap-use-after-free on address 0x6110003da268 at pc 0x7f3f2e224cdc bp 0x7ffcd1f10880 sp 0x7ffcd1f10878 READ of size 8 at 0x6110003da268 thread T0 (Web Content) #0 0x7f3f2e224cdb in Get /home/worker/workspace/build/src/obj-firefox/dist/include/PLDHashTable.h:228:26 #1 0x7f3f2e224cdb in PLDHashTable::Search(void const*) /home/worker/workspace/build/src/xpcom/glue/PLDHashTable.cpp:520 #2 0x7f3f30a2a19e in GetEntry /home/worker/workspace/build/src/obj-firefox/dist/include/nsTHashtable.h:136:7 #3 0x7f3f30a2a19e in Contains /home/worker/workspace/build/src/obj-firefox/dist/include/nsTHashtable.h:144 #4 0x7f3f30a2a19e in Contains /home/worker/workspace/build/src/obj-firefox/dist/include/nsTHashtable.h:516 #5 0x7f3f30a2a19e in mozilla::dom::DOMIntersectionObserver::UnlinkTarget(mozilla::dom::Element&) /home/worker/workspace/build/src/dom/base/DOMIntersectionObserver.cpp:170 #6 0x7f3f30faaf7e in nsNodeUtils::LastRelease(nsINode*) /home/worker/workspace/build/src/dom/base/nsNodeUtils.cpp:305:9 #7 0x7f3f30ca466c in mozilla::dom::FragmentOrElement::Release() /home/worker/workspace/build/src/dom/base/FragmentOrElement.cpp:1948:1 #8 0x7f3f2e0b2c53 in ~nsCOMPtr_base /home/worker/workspace/build/src/obj-firefox/dist/include/nsCOMPtr.h:294:7 #9 0x7f3f2e0b2c53 in ~SegmentImpl /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/SegmentedVector.h:65 #10 0x7f3f2e0b2c53 in mozilla::SegmentedVector<nsCOMPtr<nsISupports>, 4096ul, mozilla::MallocAllocPolicy>::PopLastN(unsigned int) /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/SegmentedVector.h:249 #11 0x7f3f2e089742 in mozilla::dom::DeferredFinalizerImpl<nsISupports>::DeferredFinalize(unsigned int, void*) /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/BindingUtils.h:2823:5 #12 0x7f3f2e08aaf6 in mozilla::IncrementalFinalizeRunnable::ReleaseNow(bool) /home/worker/workspace/build/src/xpcom/base/CycleCollectedJSContext.cpp:1523:17 #13 0x7f3f2e087092 in mozilla::CycleCollectedJSContext::OnGC(JSGCStatus) /home/worker/workspace/build/src/xpcom/base/CycleCollectedJSContext.cpp:1641:7 #14 0x7f3f38856b30 in callGCCallback /home/worker/workspace/build/src/js/src/jsgc.cpp:1362:9 #15 0x7f3f38856b30 in ~AutoNotifyGCActivity /home/worker/workspace/build/src/js/src/jsgc.cpp:1393 #16 0x7f3f38856b30 in js::gc::GCRuntime::gcCycle(bool, js::SliceBudget&, JS::gcreason::Reason) /home/worker/workspace/build/src/js/src/jsgc.cpp:6201 #17 0x7f3f3885828f in js::gc::GCRuntime::collect(bool, js::SliceBudget, JS::gcreason::Reason) /home/worker/workspace/build/src/js/src/jsgc.cpp:6321:25 #18 0x7f3f388379b9 in js::gc::GCRuntime::startGC(JSGCInvocationKind, JS::gcreason::Reason, long) /home/worker/workspace/build/src/js/src/jsgc.cpp:6401:5 #19 0x7f3f30d23a79 in mozilla::dom::AutoEntryScript::~AutoEntryScript() /home/worker/workspace/build/src/dom/base/ScriptSettings.cpp:676:3 #20 0x7f3f31012958 in nsScriptLoader::EvaluateScript(nsScriptLoadRequest*) /home/worker/workspace/build/src/dom/base/nsScriptLoader.cpp:2201:1 #21 0x7f3f3100f481 in nsScriptLoader::ProcessRequest(nsScriptLoadRequest*) /home/worker/workspace/build/src/dom/base/nsScriptLoader.cpp:1979:10 #22 0x7f3f31010418 in nsScriptLoader::ProcessOffThreadRequest(nsScriptLoadRequest*) /home/worker/workspace/build/src/dom/base/nsScriptLoader.cpp:1772:5 #23 0x7f3f31021b08 in (anonymous namespace)::NotifyOffThreadScriptLoadCompletedRunnable::Run() /home/worker/workspace/build/src/dom/base/nsScriptLoader.cpp:1802:17 #24 0x7f3f2e1c8acb in nsThread::ProcessNextEvent(bool, bool*) /home/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1216:7 #25 0x7f3f2e24bb0c in NS_ProcessNextEvent(nsIThread*, bool) /home/worker/workspace/build/src/xpcom/glue/nsThreadUtils.cpp:361:10 #26 0x7f3f2efe689f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /home/worker/workspace/build/src/ipc/glue/MessagePump.cpp:96:21 #27 0x7f3f2ef56678 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:232:3 #28 0x7f3f2ef56678 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:225 #29 0x7f3f2ef56678 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:205 #30 0x7f3f3460755f in nsBaseAppShell::Run() /home/worker/workspace/build/src/widget/nsBaseAppShell.cpp:156:3 #31 0x7f3f367d74f7 in XRE_RunAppShell /home/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:883:12 #32 0x7f3f2ef56678 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:232:3 #33 0x7f3f2ef56678 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:225 #34 0x7f3f2ef56678 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:205 #35 0x7f3f367d6a33 in XRE_InitChildProcess /home/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:715:7 #36 0x4dfb5b in content_process_main /home/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:197:19 #37 0x4dfb5b in main /home/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:392 #38 0x7f3f47cd7b44 in __libc_start_main /build/glibc-daoqzt/glibc-2.19/csu/libc-start.c:287 #39 0x41ba38 in _start (/home/geeknik/firefox/firefox+0x41ba38) 0x6110003da268 is located 168 bytes inside of 200-byte region [0x6110003da1c0,0x6110003da288) freed by thread T0 (Web Content) here: #0 0x4b218b in __interceptor_free /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:38:3 #1 0x7f3f2e09cb44 in SnowWhiteKiller::~SnowWhiteKiller() /home/worker/workspace/build/src/xpcom/base/nsCycleCollector.cpp:2665:9 #2 0x7f3f2e09c736 in nsCycleCollector::FreeSnowWhite(bool) /home/worker/workspace/build/src/xpcom/base/nsCycleCollector.cpp:2840:3 #3 0x7f3f2fa1fa7e in AsyncFreeSnowWhite::Run() /home/worker/workspace/build/src/js/xpconnect/src/XPCJSContext.cpp:145:34 #4 0x7f3f2e1c8acb in nsThread::ProcessNextEvent(bool, bool*) /home/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1216:7 #5 0x7f3f2e24bb0c in NS_ProcessNextEvent(nsIThread*, bool) /home/worker/workspace/build/src/xpcom/glue/nsThreadUtils.cpp:361:10 #6 0x7f3f2efe689f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /home/worker/workspace/build/src/ipc/glue/MessagePump.cpp:96:21 #7 0x7f3f2ef56678 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:232:3 #8 0x7f3f2ef56678 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:225 #9 0x7f3f2ef56678 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:205 #10 0x7f3f3460755f in nsBaseAppShell::Run() /home/worker/workspace/build/src/widget/nsBaseAppShell.cpp:156:3 #11 0x7f3f367d74f7 in XRE_RunAppShell /home/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:883:12 #12 0x7f3f2ef56678 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:232:3 #13 0x7f3f2ef56678 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:225 #14 0x7f3f2ef56678 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:205 #15 0x7f3f367d6a33 in XRE_InitChildProcess /home/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:715:7 #16 0x4dfb5b in content_process_main /home/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:197:19 #17 0x4dfb5b in main /home/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:392 #18 0x7f3f47cd7b44 in __libc_start_main /build/glibc-daoqzt/glibc-2.19/csu/libc-start.c:287 previously allocated by thread T0 (Web Content) here: #0 0x4b24ab in malloc /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:52:3 #1 0x4e0d9d in moz_xmalloc /home/worker/workspace/build/src/memory/mozalloc/mozalloc.cpp:83:17 #2 0x7f3f30a28a8e in operator new /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/mozalloc.h:194:12 #3 0x7f3f30a28a8e in mozilla::dom::DOMIntersectionObserver::Constructor(mozilla::dom::GlobalObject const&, mozilla::dom::IntersectionCallback&, mozilla::dom::IntersectionObserverInit const&, mozilla::ErrorResult&) /home/worker/workspace/build/src/dom/base/DOMIntersectionObserver.cpp:80 #4 0x7f3f328e438b in mozilla::dom::IntersectionObserverBinding::_constructor(JSContext*, unsigned int, JS::Value*) /home/worker/workspace/build/src/obj-firefox/dom/bindings/IntersectionObserverBinding.cpp:1353:69 #5 0x7f3f38c938ac in CallJSNative /home/worker/workspace/build/src/js/src/jscntxtinlines.h:239:15 #6 0x7f3f38c938ac in CallJSNativeConstructor /home/worker/workspace/build/src/js/src/jscntxtinlines.h:272 #7 0x7f3f38c938ac in InternalConstruct(JSContext*, js::AnyConstructArgs const&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:562 #8 0x7f3f38c723a3 in ConstructFromStack /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:588:12 #9 0x7f3f38c723a3 in Interpret(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2914 #10 0x7f3f38c57506 in js::RunScript(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:405:12 #11 0x7f3f38c92b44 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:477:15 #12 0x7f3f38c935b2 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:523:10 #13 0x7f3f387734ad in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/jsapi.cpp:2828:12 #14 0x7f3f323264af in mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /home/worker/workspace/build/src/obj-firefox/dom/bindings/EventHandlerBinding.cpp:259:37 #15 0x7f3f32d790b1 in Call<nsISupports *> /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/EventHandlerBinding.h:361:12 #16 0x7f3f32d790b1 in mozilla::JSEventHandler::HandleEvent(nsIDOMEvent*) /home/worker/workspace/build/src/dom/events/JSEventHandler.cpp:214 #17 0x7f3f32d42e4d in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) /home/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1134:16 #18 0x7f3f32d4483c in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) /home/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1287:17 #19 0x7f3f32d2f626 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /home/worker/workspace/build/src/dom/events/EventDispatcher.cpp:380:5 #20 0x7f3f32d32bc7 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /home/worker/workspace/build/src/dom/events/EventDispatcher.cpp:711:9 #21 0x7f3f30ff24ad in nsScriptElement::ScriptEvaluated(nsresult, nsIScriptElement*, bool) /home/worker/workspace/build/src/dom/base/nsScriptElement.cpp:74:5 #22 0x7f3f3100f5dd in nsScriptLoader::ProcessRequest(nsScriptLoadRequest*) /home/worker/workspace/build/src/dom/base/nsScriptLoader.cpp:1990:3 #23 0x7f3f310101cd in nsScriptLoader::ProcessOffThreadRequest(nsScriptLoadRequest*) /home/worker/workspace/build/src/dom/base/nsScriptLoader.cpp:1778:17 #24 0x7f3f31021b08 in (anonymous namespace)::NotifyOffThreadScriptLoadCompletedRunnable::Run() /home/worker/workspace/build/src/dom/base/nsScriptLoader.cpp:1802:17 #25 0x7f3f2e1c8acb in nsThread::ProcessNextEvent(bool, bool*) /home/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1216:7 #26 0x7f3f2e24bb0c in NS_ProcessNextEvent(nsIThread*, bool) /home/worker/workspace/build/src/xpcom/glue/nsThreadUtils.cpp:361:10 #27 0x7f3f2efe689f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /home/worker/workspace/build/src/ipc/glue/MessagePump.cpp:96:21 #28 0x7f3f2ef56678 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:232:3 #29 0x7f3f2ef56678 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:225 #30 0x7f3f2ef56678 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:205 #31 0x7f3f3460755f in nsBaseAppShell::Run() /home/worker/workspace/build/src/widget/nsBaseAppShell.cpp:156:3 #32 0x7f3f367d74f7 in XRE_RunAppShell /home/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:883:12 #33 0x7f3f2ef56678 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:232:3 #34 0x7f3f2ef56678 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:225 #35 0x7f3f2ef56678 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:205 #36 0x7f3f367d6a33 in XRE_InitChildProcess /home/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:715:7 #37 0x4dfb5b in content_process_main /home/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:197:19 #38 0x4dfb5b in main /home/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:392 #39 0x7f3f47cd7b44 in __libc_start_main /build/glibc-daoqzt/glibc-2.19/csu/libc-start.c:287 SUMMARY: AddressSanitizer: heap-use-after-free /home/worker/workspace/build/src/obj-firefox/dist/include/PLDHashTable.h:228:26 in Get Shadow bytes around the buggy address: 0x0c22800733f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c2280073400: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa 0x0c2280073410: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c2280073420: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa 0x0c2280073430: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd =>0x0c2280073440: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd 0x0c2280073450: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2280073460: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c2280073470: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa 0x0c2280073480: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c2280073490: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==7719==ABORTING
Brian: any additional information you can give us in the direction of a testcase? The seed material or initial configuration used in the fuzzer? Does this crash pop out all the time (just run the fuzzer and we should see it) or was it a one-time thing (no hope)? Looks like we've created a DOMIntersectionObserver, it was freed by cycle collection (raw pointer used somewhere?), and then used. Any ideas, Tobias?
Blocks: intersection-observer-impl
Group: core-security → layout-core-security
status-firefox52: --- → affected
status-firefox-esr45: --- → unaffected
Component: XPCOM → Layout
Flags: needinfo?(tschneider)
Flags: needinfo?(geeknik)
Keywords: csectype-uaf, testcase-wanted
Summary: ASAN: heap-use-after-free in Get @ PLDHashTable.h:228 → ASAN: heap-use-after-free in Get @ PLDHashTable.h:228 (DOMIntersectionObserver)
Flags: sec-bounty?
Daniel: Nothing special needed, just load up the URL and wait. I've repro'd it 3 times tonight and it hasn't taken over 30 minutes each time to crash the tab.
Flags: needinfo?(geeknik)
Looks more like DOM than Layout to me, based on the stack.
Component: Layout → DOM
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → DUPLICATE
Andrew, is making this a dupe useful? I mean, the other bug doesn't have a testcase and isn't going anywhere fast from what I can see?
Flags: needinfo?(continuation)
(In reply to Al Billings [:abillings] from comment #5) > Andrew, is making this a dupe useful? I mean, the other bug doesn't have a > testcase and isn't going anywhere fast from what I can see? This bug doesn't have a test case either. The other bug does have STR, like this one. I fixed it by backing out bug 1315837.
Flags: needinfo?(continuation)
I'll close the other bug once my backout has made it into a Nightly and I can confirm that the regression is fixed.
Flags: sec-bounty?
Flags: sec-bounty-
Flags: needinfo?(tschneider)
Component: DOM → DOM: Core & HTML
Group: layout-core-security
You need to log in before you can comment on or make changes to this bug.