1328760 - AddressSanitizer: heap-buffer-overflow @ nsMultiMixedConv::OnDataAvailable()

Status: RESOLVED DUPLICATE of bug 1321612

(Core :: Networking: HTTP, defect)

Description

[Bob Clary [:bc] (inactive)]

Attachment: log with asan report

Bughunter found an asan heap buffer overflow on Beta/51 Ubuntu 64bit on http://swling.com/UTC.htm

The other branches also have a variety of other problems:

Firefox Beta/51 and Aurora/52 Windows 10 32bit
Assertion failure: aNewProgress & (FLAG_SIZE_AVAILABLE | FLAG_HAS_ERROR), at c:/builds/moz2_slave/m-beta-w32-d-00000000000000000/build/src/image/ProgressTracker.cpp:41

Thread 0 (crashed)
 0  xul.dll!mozilla::image::CheckProgressConsistency [ProgressTracker.cpp:45f796204c54 : 34 + 0x24]
    eip = 0x526a5aad   esp = 0x010fefa4   ebp = 0x010fefa8   ebx = 0x0f2c9730
    esi = 0x00000029   edi = 0x010ff03c   eax = 0x55147d18   ecx = 0x73f706ef
    edx = 0x00f40000   efl = 0x00200202
    Found by: given as instruction pointer in context

Beta/51, Aurora/52 Windows 10, Windows 7

Assertion failure: aNewProgress & (FLAG_SIZE_AVAILABLE | FLAG_HAS_ERROR), at c:/builds/moz2_slave/m-aurora-w32-d-000000000000000/build/src/image/ProgressTracker.cpp:41

Thread 0 (crashed)
 0  xul.dll!mozilla::image::CheckProgressConsistency [ProgressTracker.cpp:45f796204c54 : 34 + 0x24]
    eip = 0x526a5aad   esp = 0x010fefa4   ebp = 0x010fefa8   ebx = 0x0f2c9730
    esi = 0x00000029   edi = 0x010ff03c   eax = 0x55147d18   ecx = 0x73f706ef
    edx = 0x00f40000   efl = 0x00200202

Aurora/52 Linux 64bit, Nightly/53 Windows 10 64bit

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Called Complete more than once), at c:/builds/moz2_slave/m-cen-w64-d-000000000000000000/build/src/image/SourceBuffer.cpp:467

Thread 0 (crashed)
 0  xul.dll!mozilla::image::SourceBuffer::Complete(nsresult) [SourceBuffer.cpp:31ffcb82ced8 : 467 + 0x2c]

Comment 1

[Patrick McManus [:mcmanus]]

this might be a dup of a different imglib issue that honza triaged.. I can't find the number off hand..

Comment 2

[Timothy Nikkel (:tnikkel)]

Yeah, this looks like a dupe of bug 1320899. Which is now a tracking bug to cover several issues. The bug for the networking issue is bug 1321612.

Comment 4

[Bob Clary [:bc] (inactive)]

fwiw, this occurs as far back as Firefox 29 20140102030203 and probably Firefox 22 20130401030817

Comment 5

[Timothy Nikkel (:tnikkel)]

(In reply to Bob Clary [:bc:] from comment #4)
> fwiw, this occurs as far back as Firefox 29 20140102030203 and probably
> Firefox 22 20130401030817

Yeah, the code here is super old.

Comment 6

[Honza Bambas (:mayhemer)]

(In reply to Patrick McManus [:mcmanus] from comment #1)
> this might be a dup of a different imglib issue that honza triaged.. I can't
> find the number off hand..

yep, thanks.