Closed
Bug 1377427
Opened 7 years ago
Closed 7 years ago
heap-buffer-overflow in hsw::convolve_vertically
Categories
(Core :: Graphics, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 1375842
People
(Reporter: tk.mozilla, Unassigned)
References
Details
(4 keywords, Whiteboard: Possible dupe of bug 1375842 [gfx-noted])
Attachments
(1 file)
|
576 bytes,
text/html
|
Details |
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36
Steps to reproduce:
The testcase (testcase.html) crashes the latest ASAN build (CodeName=Nightly, Version=56.0a1, BuildID=20170629202242, 64-bit) of Firefox on Linux as follows:
=================================================================
==24078==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60600018eabf at pc 0x7fd88bd60f49 bp 0x7fd873664370 sp 0x7fd873664368
READ of size 32 at 0x60600018eabf thread T17 (ImgDecoder #1)
#0 0x7fd88bd60f48 in hsw::convolve_vertically(short const*, int, unsigned char* const*, int, unsigned char*, bool) /home/worker/workspace/build/src/gfx/skia/skia/src/opts/SkOpts_hsw.cpp:57:54
#1 0x7fd8856aa76d in operator() /home/worker/workspace/build/src/image/DownscalingFilter.h:283:16
#2 0x7fd8856aa76d in WriteUnsafeComputedRow<unsigned int, (lambda at /home/worker/workspace/build/src/image/DownscalingFilter.h:281:53)> /home/worker/workspace/build/src/image/SurfacePipe.h:386
#3 0x7fd8856aa76d in mozilla::image::DownscalingFilter<mozilla::image::SurfaceSink>::DownscaleInputRow() /home/worker/workspace/build/src/image/DownscalingFilter.h:281
#4 0x7fd8856aa227 in mozilla::image::DownscalingFilter<mozilla::image::SurfaceSink>::DoAdvanceRow() /home/worker/workspace/build/src/image/DownscalingFilter.h:245:7
#5 0x7fd8856a3848 in AdvanceRow /home/worker/workspace/build/src/image/SurfacePipe.h:131:19
#6 0x7fd8856a3848 in DoWritePixelsToRow<unsigned int, (lambda at /home/worker/workspace/build/src/image/decoders/nsPNGDecoder.cpp:913:49)> /home/worker/workspace/build/src/image/SurfacePipe.h:499
#7 0x7fd8856a3848 in WritePixelsToRow<unsigned int, (lambda at /home/worker/workspace/build/src/image/decoders/nsPNGDecoder.cpp:913:49)> /home/worker/workspace/build/src/image/SurfacePipe.h:209
#8 0x7fd8856a3848 in WritePixelsToRow<unsigned int, (lambda at /home/worker/workspace/build/src/image/decoders/nsPNGDecoder.cpp:913:49)> /home/worker/workspace/build/src/image/SurfacePipe.h:619
#9 0x7fd8856a3848 in mozilla::image::nsPNGDecoder::WriteRow(unsigned char*) /home/worker/workspace/build/src/image/decoders/nsPNGDecoder.cpp:913
#10 0x7fd88b29048b in MOZ_PNG_push_have_row /home/worker/workspace/build/src/media/libpng/pngpread.c:1208:7
#11 0x7fd88b29048b in MOZ_PNG_push_proc_row /home/worker/workspace/build/src/media/libpng/pngpread.c:1119
#12 0x7fd88b28f95b in MOZ_PNG_proc_IDAT_data /home/worker/workspace/build/src/media/libpng/pngpread.c:878:13
#13 0x7fd88b28809f in MOZ_PNG_push_read_IDAT /home/worker/workspace/build/src/media/libpng/pngpread.c:754:7
#14 0x7fd88b2842b7 in MOZ_PNG_proc_some_data /home/worker/workspace/build/src/media/libpng/pngpread.c:115:10
#15 0x7fd88b2842b7 in MOZ_PNG_process_data /home/worker/workspace/build/src/media/libpng/pngpread.c:46
#16 0x7fd8856a1ea0 in mozilla::image::nsPNGDecoder::ReadPNGData(char const*, unsigned long) /home/worker/workspace/build/src/image/decoders/nsPNGDecoder.cpp:404:3
#17 0x7fd8856cc792 in operator() /home/worker/workspace/build/src/image/decoders/nsPNGDecoder.cpp:374:16
#18 0x7fd8856cc792 in mozilla::Maybe<mozilla::Variant<mozilla::image::TerminalState, mozilla::image::Yield> > mozilla::image::StreamingLexer<mozilla::image::nsPNGDecoder::State, 16ul>::ContinueUnbufferedRead<mozilla::image::nsPNGDecoder::DoDecode(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*)::$_8>(char const*, unsigned long, unsigned long, mozilla::image::nsPNGDecoder::DoDecode(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*)::$_8) /home/worker/workspace/build/src/image/StreamingLexer.h:541
#19 0x7fd88569c779 in UnbufferedRead<(lambda at /home/worker/workspace/build/src/image/decoders/nsPNGDecoder.cpp:371:21)> /home/worker/workspace/build/src/image/StreamingLexer.h:485:12
#20 0x7fd88569c779 in Lex<(lambda at /home/worker/workspace/build/src/image/decoders/nsPNGDecoder.cpp:371:21)> /home/worker/workspace/build/src/image/StreamingLexer.h:453
#21 0x7fd88569c779 in mozilla::image::nsPNGDecoder::DoDecode(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*) /home/worker/workspace/build/src/image/decoders/nsPNGDecoder.cpp:370
#22 0x7fd8855798e8 in mozilla::image::Decoder::Decode(mozilla::image::IResumable*) /home/worker/workspace/build/src/image/Decoder.cpp:130:20
#23 0x7fd8855875ae in mozilla::image::DecodedSurfaceProvider::Run() /home/worker/workspace/build/src/image/DecodedSurfaceProvider.cpp:139:34
#24 0x7fd8855a8091 in mozilla::image::DecodePoolWorker::Run() /home/worker/workspace/build/src/image/DecodePool.cpp:178:23
#25 0x7fd882f8b558 in nsThread::ProcessNextEvent(bool, bool*) /home/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1422:14
#26 0x7fd882f916a8 in NS_ProcessNextEvent(nsIThread*, bool) /home/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:474:10
#27 0x7fd883d6b3c0 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /home/worker/workspace/build/src/ipc/glue/MessagePump.cpp:339:20
#28 0x7fd883cc6a10 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:320:10
#29 0x7fd883cc6a10 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:313
#30 0x7fd883cc6a10 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:293
#31 0x7fd882f8329d in nsThread::ThreadFunc(void*) /home/worker/workspace/build/src/xpcom/threads/nsThread.cpp:504:11
#32 0x7fd89d0e8423 in _pt_root /home/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:216:5
#33 0x7fd8a06df6f9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76f9)
#34 0x7fd89f768b5c in clone /build/glibc-GKVZIf/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109
0x60600018eabf is located 8 bytes to the right of 55-byte region [0x60600018ea80,0x60600018eab7)
allocated by thread T17 (ImgDecoder #1) here:
#0 0x4bb9ec in malloc /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64:3
#1 0x7fd8856ab908 in operator new[] /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/mozalloc.h:268:12
#2 0x7fd8856ab908 in nsresult mozilla::image::DownscalingFilter<mozilla::image::SurfaceSink>::Configure<mozilla::image::SurfaceConfig>(mozilla::image::DownscalingConfig const&, mozilla::image::SurfaceConfig) /home/worker/workspace/build/src/image/DownscalingFilter.h:182
#3 0x7fd8856a5aba in mozilla::Maybe<mozilla::image::SurfacePipe> mozilla::image::SurfacePipeFactory::MakePipe<mozilla::image::DownscalingConfig, mozilla::image::SurfaceConfig>(mozilla::image::DownscalingConfig, mozilla::image::SurfaceConfig) /home/worker/workspace/build/src/image/SurfacePipeFactory.h:235:25
#4 0x7fd885661b8a in mozilla::image::SurfacePipeFactory::CreateSurfacePipe(mozilla::image::Decoder*, unsigned int, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::SurfaceFormat, mozilla::image::SurfacePipeFlags) /home/worker/workspace/build/src/image/SurfacePipeFactory.h:150:18
#5 0x7fd885696dcd in mozilla::image::nsPNGDecoder::CreateFrame(mozilla::image::nsPNGDecoder::FrameInfo const&) /home/worker/workspace/build/src/image/decoders/nsPNGDecoder.cpp:218:5
#6 0x7fd885698906 in mozilla::image::nsPNGDecoder::info_callback(png_struct_def*, png_info_def*) /home/worker/workspace/build/src/image/decoders/nsPNGDecoder.cpp:725:28
#7 0x7fd88b2863ce in MOZ_PNG_push_have_info /home/worker/workspace/build/src/media/libpng/pngpread.c:1194:7
#8 0x7fd88b2863ce in MOZ_PNG_push_read_chunk /home/worker/workspace/build/src/media/libpng/pngpread.c:351
#9 0x7fd88b2842ab in MOZ_PNG_proc_some_data /home/worker/workspace/build/src/media/libpng/pngpread.c:109:10
#10 0x7fd88b2842ab in MOZ_PNG_process_data /home/worker/workspace/build/src/media/libpng/pngpread.c:46
#11 0x7fd8856a1ea0 in mozilla::image::nsPNGDecoder::ReadPNGData(char const*, unsigned long) /home/worker/workspace/build/src/image/decoders/nsPNGDecoder.cpp:404:3
#12 0x7fd8856cc792 in operator() /home/worker/workspace/build/src/image/decoders/nsPNGDecoder.cpp:374:16
#13 0x7fd8856cc792 in mozilla::Maybe<mozilla::Variant<mozilla::image::TerminalState, mozilla::image::Yield> > mozilla::image::StreamingLexer<mozilla::image::nsPNGDecoder::State, 16ul>::ContinueUnbufferedRead<mozilla::image::nsPNGDecoder::DoDecode(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*)::$_8>(char const*, unsigned long, unsigned long, mozilla::image::nsPNGDecoder::DoDecode(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*)::$_8) /home/worker/workspace/build/src/image/StreamingLexer.h:541
#14 0x7fd88569c779 in UnbufferedRead<(lambda at /home/worker/workspace/build/src/image/decoders/nsPNGDecoder.cpp:371:21)> /home/worker/workspace/build/src/image/StreamingLexer.h:485:12
#15 0x7fd88569c779 in Lex<(lambda at /home/worker/workspace/build/src/image/decoders/nsPNGDecoder.cpp:371:21)> /home/worker/workspace/build/src/image/StreamingLexer.h:453
#16 0x7fd88569c779 in mozilla::image::nsPNGDecoder::DoDecode(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*) /home/worker/workspace/build/src/image/decoders/nsPNGDecoder.cpp:370
#17 0x7fd8855798e8 in mozilla::image::Decoder::Decode(mozilla::image::IResumable*) /home/worker/workspace/build/src/image/Decoder.cpp:130:20
#18 0x7fd8855875ae in mozilla::image::DecodedSurfaceProvider::Run() /home/worker/workspace/build/src/image/DecodedSurfaceProvider.cpp:139:34
#19 0x7fd8855a8091 in mozilla::image::DecodePoolWorker::Run() /home/worker/workspace/build/src/image/DecodePool.cpp:178:23
#20 0x7fd882f8b558 in nsThread::ProcessNextEvent(bool, bool*) /home/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1422:14
#21 0x7fd882f916a8 in NS_ProcessNextEvent(nsIThread*, bool) /home/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:474:10
#22 0x7fd883d6b3c0 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /home/worker/workspace/build/src/ipc/glue/MessagePump.cpp:339:20
#23 0x7fd883cc6a10 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:320:10
#24 0x7fd883cc6a10 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:313
#25 0x7fd883cc6a10 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:293
#26 0x7fd882f8329d in nsThread::ThreadFunc(void*) /home/worker/workspace/build/src/xpcom/threads/nsThread.cpp:504:11
#27 0x7fd89d0e8423 in _pt_root /home/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:216:5
#28 0x7fd8a06df6f9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76f9)
Thread T17 (ImgDecoder #1) created by T0 (Web Content) here:
#0 0x4a3dc6 in __interceptor_pthread_create /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:245:3
#1 0x7fd89d0e51c9 in _PR_CreateThread /home/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:457:14
#2 0x7fd89d0e4dde in PR_CreateThread /home/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:548:12
#3 0x7fd882f857ee in nsThread::Init(nsACString const&) /home/worker/workspace/build/src/xpcom/threads/nsThread.cpp:686:8
#4 0x7fd882f9085f in nsThreadManager::NewNamedThread(nsACString const&, unsigned int, nsIThread**) /home/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:273:22
#5 0x7fd882f93df3 in NS_NewNamedThread(nsACString const&, nsIThread**, nsIRunnable*, unsigned int) /home/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:113:45
#6 0x7fd885584a75 in mozilla::image::DecodePoolImpl::CreateThread(nsIThread**, nsIRunnable*) /home/worker/workspace/build/src/image/DecodePool.cpp:133:12
#7 0x7fd8855841e3 in mozilla::image::DecodePool::DecodePool() /home/worker/workspace/build/src/image/DecodePool.cpp:262:26
#8 0x7fd8855836b0 in Singleton /home/worker/workspace/build/src/image/DecodePool.cpp:214:22
#9 0x7fd8855836b0 in mozilla::image::DecodePool::Initialize() /home/worker/workspace/build/src/image/DecodePool.cpp:206
#10 0x7fd885649e45 in mozilla::image::EnsureModuleInitialized() /home/worker/workspace/build/src/image/build/nsImageModule.cpp:104:3
#11 0x7fd882f457d8 in Load /home/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:779:21
#12 0x7fd882f457d8 in nsFactoryEntry::GetFactory() /home/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:1797
#13 0x7fd882f46c5d in nsComponentManagerImpl::CreateInstanceByContractID(char const*, nsISupports*, nsID const&, void**) /home/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:1099:41
#14 0x7fd882f3e1bb in nsComponentManagerImpl::GetServiceByContractID(char const*, nsID const&, void**) /home/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:1458:10
#15 0x7fd882f4c941 in CallGetService /home/worker/workspace/build/src/xpcom/components/nsComponentManagerUtils.cpp:67:43
#16 0x7fd882f4c941 in nsGetServiceByContractID::operator()(nsID const&, void**) const /home/worker/workspace/build/src/xpcom/components/nsComponentManagerUtils.cpp:280
#17 0x7fd882e19de3 in nsCOMPtr_base::assign_from_gs_contractid(nsGetServiceByContractID, nsID const&) /home/worker/workspace/build/src/xpcom/base/nsCOMPtr.cpp:95:7
#18 0x7fd88535768c in nsCOMPtr /home/worker/workspace/build/src/obj-firefox/dist/include/nsCOMPtr.h:555:5
#19 0x7fd88535768c in gfxPlatform::Init() /home/worker/workspace/build/src/gfx/thebes/gfxPlatform.cpp:803
#20 0x7fd8853591b9 in gfxPlatform::InitChild(mozilla::gfx::ContentDeviceData const&) /home/worker/workspace/build/src/gfx/thebes/gfxPlatform.cpp:564:3
#21 0x7fd888bd150f in InitGraphicsDeviceData /home/worker/workspace/build/src/dom/ipc/ContentChild.cpp:1084:3
#22 0x7fd888bd150f in mozilla::dom::ContentChild::RecvSetXPCOMProcessAttributes(mozilla::dom::XPCOMInitData const&, mozilla::dom::ipc::StructuredCloneData const&, nsTArray<LookAndFeelInt>&&) /home/worker/workspace/build/src/dom/ipc/ContentChild.cpp:540
#23 0x7fd88452e6f6 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /home/worker/workspace/build/src/obj-firefox/ipc/ipdl/PContentChild.cpp:7051:20
#24 0x7fd883d6236e in mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) /home/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2093:25
#25 0x7fd883d5f184 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /home/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2019:17
#26 0x7fd883d60dd4 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /home/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:1888:5
#27 0x7fd883d613b8 in mozilla::ipc::MessageChannel::MessageTask::Run() /home/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:1921:15
#28 0x7fd882f8b558 in nsThread::ProcessNextEvent(bool, bool*) /home/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1422:14
#29 0x7fd882f916a8 in NS_ProcessNextEvent(nsIThread*, bool) /home/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:474:10
#30 0x7fd883d6a021 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /home/worker/workspace/build/src/ipc/glue/MessagePump.cpp:97:21
#31 0x7fd883cc6a10 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:320:10
#32 0x7fd883cc6a10 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:313
#33 0x7fd883cc6a10 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:293
#34 0x7fd8893a0b9f in nsBaseAppShell::Run() /home/worker/workspace/build/src/widget/nsBaseAppShell.cpp:156:27
#35 0x7fd88d5d2ee7 in XRE_RunAppShell() /home/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:895:22
#36 0x7fd883cc6a10 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:320:10
#37 0x7fd883cc6a10 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:313
#38 0x7fd883cc6a10 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:293
#39 0x7fd88d5d294d in XRE_InitChildProcess(int, char**, XREChildData const*) /home/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:711:34
#40 0x4eb813 in content_process_main /home/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:64:30
#41 0x4eb813 in main /home/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:286
#42 0x7fd89f68282f in __libc_start_main /build/glibc-GKVZIf/glibc-2.23/csu/../csu/libc-start.c:291
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/worker/workspace/build/src/gfx/skia/skia/src/opts/SkOpts_hsw.cpp:57:54 in hsw::convolve_vertically(short const*, int, unsigned char* const*, int, unsigned char*, bool)
Shadow bytes around the buggy address:
0x0c0c80029d00: 00 00 07 fa fa fa fa fa 00 00 00 00 00 00 07 fa
0x0c0c80029d10: fa fa fa fa 00 00 00 00 00 00 07 fa fa fa fa fa
0x0c0c80029d20: 00 00 00 00 00 00 07 fa fa fa fa fa 00 00 00 00
0x0c0c80029d30: 00 00 07 fa fa fa fa fa 00 00 00 00 00 00 07 fa
0x0c0c80029d40: fa fa fa fa 00 00 00 00 00 00 07 fa fa fa fa fa
=>0x0c0c80029d50: 00 00 00 00 00 00 07[fa]fa fa fa fa fd fd fd fd
0x0c0c80029d60: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
0x0c0c80029d70: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
0x0c0c80029d80: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
0x0c0c80029d90: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
0x0c0c80029da0: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==24078==ABORTING
|
||
Updated•7 years ago
|
Group: firefox-core-security → gfx-core-security
Component: Untriaged → Graphics
Product: Firefox → Core
|
||
Comment 1•7 years ago
|
||
I'm going to go ahead and mark the dependency. When we fix bug 1375842 we need to retest this one to confirm it really is the same issue.
Depends on: 1375842
Whiteboard: Possible dupe of bug 1375842
|
||
Updated•7 years ago
|
Whiteboard: Possible dupe of bug 1375842 → Possible dupe of bug 1375842 [gfx-noted]
|
||
Comment 2•7 years ago
|
||
This is fixed by the patch in bug 1375842.
Status: UNCONFIRMED → RESOLVED
Closed: 7 years ago
Resolution: --- → DUPLICATE
|
|
||
Updated•4 years ago
|
Group: gfx-core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•