1352122 - webcontent process crash due to null pointer dereference

Status: RESOLVED DUPLICATE of bug 1348941

(Core :: Graphics: Canvas2D, enhancement)

Description

[Julian Hector [:tedd] [:jhector]]

Attachment: Crash PoC - this should crash your tab

I was trying to investigate a potential integer overflow, which eventually can be leveraged to allocate insufficient memory.

In the nsBMPEncoder, the bmp file size is calculated by multiplying as can be seen here [1].

The calculated file size is used to allocate memory for the image buffer inside the  StartImageEncode() function [2]. Given a specially crafted width and height, it should be possible for the multiplication to wrap around, thus leading to an allocation of insufficient memory.

I tried to trigger this potential bug by using a canvas and converting it to a data URL (this is the code path I chose to investigate).

I failed to reach the described code due to a missing null check here [3] which leads to the null pointer deref here [4]

So why marking it as a secure bug?
Well, I didn't want to sink too much time into investigating this because I don't know the code and would have to understand it first which takes time. I do believe however that file size calculation is dangerous and should be performed using the CheckedInt class [5], maybe there is another way to reach that code without failing first, so in case such a code path exists, I don't want to tip off anybody.

We should probably find someone who knows the code and can investigate this more.

The attached PoC code crashes the content process reliably (thanks to :pauljt for also testing this).

[1] http://searchfox.org/mozilla-central/rev/7419b368156a6efa24777b21b0e5706be89a9c2f/image/encoders/bmp/nsBMPEncoder.cpp#494,496-497
[2] http://searchfox.org/mozilla-central/rev/7419b368156a6efa24777b21b0e5706be89a9c2f/image/encoders/bmp/nsBMPEncoder.cpp#137-138
[3] http://searchfox.org/mozilla-central/rev/7419b368156a6efa24777b21b0e5706be89a9c2f/dom/canvas/ImageBitmapRenderingContext.cpp#149
[4] http://searchfox.org/mozilla-central/rev/7419b368156a6efa24777b21b0e5706be89a9c2f/gfx/2d/DataSurfaceHelpers.cpp#134
[5] http://searchfox.org/mozilla-central/rev/7419b368156a6efa24777b21b0e5706be89a9c2f/mfbt/CheckedInt.h#500

Comment 1

[Julian Hector [:tedd] [:jhector]]

Attachment: GDB backtrace of crash.

Comment 2

[Daniel Veditz [:dveditz]]

We think this is fixed by bug 1348941