Closed Bug 1393610 Opened 8 years ago Closed 8 years ago

Crash in mozilla::dom::DOMIntersectionObserver::Notify

Categories

(Core :: Layout, defect, P3)

Product:
Core
Component:
Layout
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla57
Tracking Flags:
Tracking Status
firefox-esr52 --- unaffected
firefox57 --- fixed

People

(Reporter: tschneider, Assigned: tschneider)

References

Details

(Keywords: csectype-uaf, sec-high)

Crash Data

No description provided.
Crash Signature: [@mozilla::dom::DOMIntersectionObserver::Notify]
Looks like a missing null check in http://searchfox.org/mozilla-central/rev/5696c3e525fc8222674eed6a562f5fcbe804c4c7/dom/base/nsDocument.cpp#13121 leading to accessing a released pointer if an Intersection Observer objects gets collected underneath the iterator as a result of executing content scripts. Working on a test case to confirm.
Depends on: 1394522
Assignee: nobody → tschneider
Group: layout-core-security, core-security
Group: core-security
Priority: -- → P3
(assuming current Nightly, version 57, is affected -- marking as such)
status-firefox57: --- → affected
Jet, do you know what the status of this bug is? It looks like the current assignee is not using Bugzilla anymore. From reading the last comments on the dependent bug 1398437, it looks like some other work has been going on to solve this issue?
Flags: needinfo?(bugs)
This should now be fixed.
Status: NEW → RESOLVED
Closed: 8 years ago
Flags: needinfo?(bugs)
Resolution: --- → FIXED
Group: layout-core-security → core-security-release
status-firefox57: affected → fixed
status-firefox-esr52: --- → unaffected
Target Milestone: --- → mozilla57
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.