1321151 - Crash in strncmp

Status: RESOLVED INCOMPLETE

(External Software Affecting Firefox Graveyard :: Flash (Adobe), defect)

Description

[Mats Palmgren (inactive)]

This bug was filed from the Socorro interface and is 
report bp-d2cd96bf-45e3-4f9f-a36e-eae5e2161128.
=============================================================

There's a huge spike of crashes in 'strncmp' called from Flash code in v51 (Beta).
Crash statistics for the past 7 days:

Operating System	Count	Percentage
Windows 7	4759	95.2%
Windows 10	139	2.8%
Windows 8.1	98	2.0%
Windows 8	3	0.1%

Product	Version	Count	Percentage	Installations
Firefox	51.0b2	1656	29.7%	111
Firefox	51.0b3	1487	26.6%	127
Firefox	51.0b1	407	7.3%	50
Firefox	50.0b99	338	6.1%	15
Firefox	50.0	237	4.2%	155
Firefox	44.0b1	209	3.7%	67
Firefox	53.0a1	194	3.5%	10
...


Flash™ Version	Count	Percentage
23.0.0.207	4145	82.9%
22.0.0.158	410	8.2%
23.0.0.205	120	2.4%
24.0.0.138	104	2.1%
22.0.0.209	55	1.1%
23.0.0.185	30	0.6%
23.0.0.162	21	0.4%
23.0.0.198	15	0.3%
14.0.0.146	10	0.2%
20.0.0.306	8	0.2%
18.0.0.232	7	0.1%
...


Stack:
flashplayerplugin_23_0_0_207.exe	strncmp	f:\dd\vctools\crt_bld\self_x86\crt\src\intel\strncmp.c:56
flashplayerplugin_23_0_0_207.exe	TargetInternetOpenA	F2136843762________________________________________________________________________________________:421
symsrv.dll	symsrv.dll@0x3b5c	
symsrv.dll	symsrv.dll@0x40ca	
symsrv.dll	symsrv.dll@0x7668	
symsrv.dll	symsrv.dll@0x792d	
symsrv.dll	symsrv.dll@0xd3c7	
symsrv.dll	symsrv.dll@0x11e53	
kernel32.dll	BaseThreadInitThunk	
ntdll.dll	__RtlUserThreadStart	
ntdll.dll	_RtlUserThreadStart

Comment 1

[Gerry Chang [:gchang]]

Track 51+ as topcrash.

Hi :kanru,
Can you help shed some light here?

Comment 2

[Benjamin Smedberg]

This is a crash entirely within Flash code. I doubt having a Mozilla engineering spend time on it would be fruitful.

It's interesting that symsrv.dll is on the stack; that's pretty unusual and indicates some kind of developer mode I think.

Need to figure out whether all of these crashes are strncmp/TargetInternetOpenA/F213.../symsrv or whether there are other patterns. It may be that *this* new regression is from 23.0.0.207 and previous builds have other lower-volume crashes which also happen to be strncmp.

Probably also worth adding strcmp to the appendlist, since it's by definition not interesting by itself. I filed bug 1321288 for that.

Comment 3

[Benjamin Smedberg]

I verified that this is all TargetInternetOpenA. It appears that symsrv.dll may be a virus, and there's also dlcoer.dll loaded in some of these reports which is a known virus.

Unless you think it's valuable to try and notify these users to run a virus removal tool, I think we should INCOMPLETE this.

Comment 4

[Mats Palmgren (inactive)]

> Unless you think it's valuable to try and notify these users to run a virus removal tool

It looks like a few of them provided an email address, so I guess we could try
sending a mail to inform them.  Then again, I suppose it's hard to avoid
making that message just look like regular spam with links to "virus removal"
tools...  so it's probably not worth the effort.

Comment 5

[Gerry Chang [:gchang]]

Per comment #3 and #4, mark 51 won't fix.