Closed Bug 1404753 Opened 7 years ago Closed 7 years ago

stylo: AddressSanitizer: use-after-poison /builds/worker/workspace/build/src/layout/generic/nsIFrame.h:1997:46 in GetStateBits

Categories

(Core :: CSS Parsing and Computation, defect, P3)

Product:
Core
Component:
CSS Parsing and Computation
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1404324

People

(Reporter: jkratzer, Assigned: emilio)

References

(Blocks 1 open bug)

Details

(4 keywords)

Attachments

(1 file)

trigger.html
526 bytes, text/html
Details
Attached file trigger.html —
Testcase found while fuzzing mozilla-central rev 41286177c59c. ==13578==ERROR: AddressSanitizer: use-after-poison on address 0x6250012e6300 at pc 0x7f3fdfc26aa0 bp 0x7fff95567e70 sp 0x7fff95567e68 READ of size 8 at 0x6250012e6300 thread T0 #0 0x7f3fdfc26a9f in GetStateBits /builds/worker/workspace/build/src/layout/generic/nsIFrame.h:1997:46 #1 0x7f3fdfc26a9f in nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) /builds/worker/workspace/build/src/layout/base/nsFrameManager.cpp:605 #2 0x7f3fdfc085ed in CaptureStateForFramesOf /builds/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:9646:5 #3 0x7f3fdfc085ed in nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, nsCSSFrameConstructor::InsertionKind) /builds/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:10061 #4 0x7f3fdfc1ae90 in nsCSSFrameConstructor::WipeContainingBlock(nsFrameConstructorState&, nsIFrame*, nsIFrame*, nsCSSFrameConstructor::FrameConstructionItemList&, bool, nsIFrame*) /builds/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:13139:3 #5 0x7f3fdfc124d4 in nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsIContent*, nsILayoutHistoryState*, nsCSSFrameConstructor::InsertionKind, TreeMatchContext*) /builds/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:8415:7 #6 0x7f3fdfc086f0 in nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, nsCSSFrameConstructor::InsertionKind) /builds/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:10090:9 #7 0x7f3fdfb3674a in mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) /builds/worker/workspace/build/src/layout/base/RestyleManager.cpp:1513:25 #8 0x7f3fdfbab037 in mozilla::ServoRestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /builds/worker/workspace/build/src/layout/base/ServoRestyleManager.cpp:1132:9 #9 0x7f3fdfb6a910 in ProcessPendingRestyles /builds/worker/workspace/build/src/layout/base/ServoRestyleManager.cpp:1187:3 #10 0x7f3fdfb6a910 in ProcessPendingRestyles /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RestyleManagerInlines.h:44 #11 0x7f3fdfb6a910 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:4145 #12 0x7f3fdbac2760 in FlushPendingNotifications /builds/worker/workspace/build/src/obj-firefox/dist/include/nsIPresShell.h:557:5 #13 0x7f3fdbac2760 in nsDocument::FlushPendingNotifications(mozilla::FlushType, mozilla::FlushTarget) /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:8499 #14 0x7f3fda9004fd in nsDocLoader::DocLoaderIsEmpty(bool) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:703:14 #15 0x7f3fda902785 in nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:632:5 #16 0x7f3fda9033ec in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:488:14 #17 0x7f3fd8ee6afd in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/workspace/build/src/netwerk/base/nsLoadGroup.cpp:629:28 #18 0x7f3fdbac877d in nsDocument::DoUnblockOnload() /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:9328:18 #19 0x7f3fdbac8341 in nsDocument::UnblockOnload(bool) /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:9250:9 #20 0x7f3fdbaa1909 in nsDocument::DispatchContentLoadedEvents() /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:5601:3 #21 0x7f3fdbb1b0d2 in applyImpl<nsDocument, void (nsDocument::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1142:12 #22 0x7f3fdbb1b0d2 in apply<nsDocument, void (nsDocument::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1148 #23 0x7f3fdbb1b0d2 in mozilla::detail::RunnableMethodImpl<nsDocument*, void (nsDocument::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1192 #24 0x7f3fd8d39722 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1039:14 #25 0x7f3fd8d533f8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:524:10 #26 0x7f3fd9ae3541 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:97:21 #27 0x7f3fd9a458ab in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10 #28 0x7f3fd9a458ab in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319 #29 0x7f3fd9a458ab in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299 #30 0x7f3fdf3ffbbf in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:158:27 #31 0x7f3fe355c191 in nsAppStartup::Run() /builds/worker/workspace/build/src/toolkit/components/startup/nsAppStartup.cpp:288:30 #32 0x7f3fe374d15b in XREMain::XRE_mainRun() /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4701:22 #33 0x7f3fe374ed78 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4865:8 #34 0x7f3fe37501ab in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4960:21 #35 0x4ebfe3 in do_main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:231:22 #36 0x4ebfe3 in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:304 #37 0x7f3ff6a5f82f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291 #38 0x41db38 in _start (/home/forb1dden/builds/mc-asan/firefox+0x41db38) 0x6250012e6300 is located 2560 bytes inside of 8192-byte region [0x6250012e5900,0x6250012e7900) allocated by thread T0 here: #0 0x4bc3bc in malloc /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64:3 #1 0x7f3fd8cede1f in AllocateChunk /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ArenaAllocator.h:179:15 #2 0x7f3fd8cede1f in InternalAllocate /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ArenaAllocator.h:214 #3 0x7f3fd8cede1f in Allocate /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ArenaAllocator.h:72 #4 0x7f3fd8cede1f in mozilla::ArenaAllocator<8192ul, 8ul>::Allocate(unsigned long) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ArenaAllocator.h:77 #5 0x7f3fdfd50443 in AllocateByFrameID /builds/worker/workspace/build/src/layout/base/nsPresArena.h:38:12 #6 0x7f3fdfd50443 in AllocateFrame /builds/worker/workspace/build/src/obj-firefox/dist/include/nsIPresShell.h:203 #7 0x7f3fdfd50443 in operator new /builds/worker/workspace/build/src/layout/generic/ViewportFrame.cpp:33 #8 0x7f3fdfd50443 in NS_NewViewportFrame(nsIPresShell*, nsStyleContext*) /builds/worker/workspace/build/src/layout/generic/ViewportFrame.cpp:30 #9 0x7f3fdfbf1804 in nsCSSFrameConstructor::ConstructRootFrame() /builds/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:2830:5 #10 0x7f3fdfb511db in mozilla::PresShell::Initialize(int, int) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:1729:36 #11 0x7f3fdba0c020 in nsContentSink::StartLayout(bool) /builds/worker/workspace/build/src/dom/base/nsContentSink.cpp:1286:26 #12 0x7f3fdbac24e6 in nsDocument::FlushPendingNotifications(mozilla::FlushType, mozilla::FlushTarget) /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:8470:13 #13 0x7f3fdb87cb67 in GetPrimaryFrame /builds/worker/workspace/build/src/dom/base/Element.cpp:2303:10 #14 0x7f3fdb87cb67 in mozilla::dom::Element::GetBoundingClientRect() /builds/worker/workspace/build/src/dom/base/Element.cpp:1074 #15 0x7f3fdd0ca43c in mozilla::dom::ElementBinding::getBoundingClientRect(JSContext*, JS::Handle<JSObject*>, mozilla::dom::Element*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/ElementBinding.cpp:2430:59 #16 0x7f3fdd5bc300 in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:3053:13 #17 0x7f3fe3a04714 in CallJSNative /builds/worker/workspace/build/src/js/src/jscntxtinlines.h:293:15 #18 0x7f3fe3a04714 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:495 #19 0x7f3fe39ee576 in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:546:12 #20 0x7f3fe39ee576 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3084 #21 0x7f3fe39d5939 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:435:12 #22 0x7f3fe3a07027 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:724:15 #23 0x7f3fe3a07892 in js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:756:12 #24 0x7f3fe4457d09 in ExecuteScript(JSContext*, JS::AutoObjectVector&, JS::Handle<JSScript*>, JS::Value*) /builds/worker/workspace/build/src/js/src/jsapi.cpp:4667:12 #25 0x7f3fdbbbfde9 in nsJSUtils::ExecutionContext::CompileAndExec(JS::CompileOptions&, JS::SourceBufferHolder&, JS::MutableHandle<JSScript*>) /builds/worker/workspace/build/src/dom/base/nsJSUtils.cpp:265:8 #26 0x7f3fdf29e7d8 in mozilla::dom::ScriptLoader::EvaluateScript(mozilla::dom::ScriptLoadRequest*) /builds/worker/workspace/build/src/dom/script/ScriptLoader.cpp:2244:25 #27 0x7f3fdf299c0c in mozilla::dom::ScriptLoader::ProcessRequest(mozilla::dom::ScriptLoadRequest*) /builds/worker/workspace/build/src/dom/script/ScriptLoader.cpp:1884:10 #28 0x7f3fdf27d465 in mozilla::dom::ScriptLoader::ProcessScriptElement(nsIScriptElement*) /builds/worker/workspace/build/src/dom/script/ScriptLoader.cpp:1585:10 #29 0x7f3fdf2799c8 in mozilla::dom::ScriptElement::MaybeProcessScript() /builds/worker/workspace/build/src/dom/script/ScriptElement.cpp:149:18 #30 0x7f3fdaade17f in AttemptToExecute /builds/worker/workspace/build/src/obj-firefox/dist/include/nsIScriptElement.h:225:18 #31 0x7f3fdaade17f in nsHtml5TreeOpExecutor::RunScript(nsIContent*) /builds/worker/workspace/build/src/parser/html/nsHtml5TreeOpExecutor.cpp:700 #32 0x7f3fdaad7c2a in nsHtml5TreeOpExecutor::RunFlushLoop() /builds/worker/workspace/build/src/parser/html/nsHtml5TreeOpExecutor.cpp:501:7 #33 0x7f3fdaae1bfb in nsHtml5ExecutorFlusher::Run() /builds/worker/workspace/build/src/parser/html/nsHtml5StreamParser.cpp:130:20 #34 0x7f3fd8d39722 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1039:14 #35 0x7f3fd8d533f8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:524:10 #36 0x7f3fd9ae3541 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:97:21 #37 0x7f3fd9a458ab in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10 #38 0x7f3fd9a458ab in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319 #39 0x7f3fd9a458ab in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299 #40 0x7f3fdf3ffbbf in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:158:27 #41 0x7f3fe355c191 in nsAppStartup::Run() /builds/worker/workspace/build/src/toolkit/components/startup/nsAppStartup.cpp:288:30 SUMMARY: AddressSanitizer: use-after-poison /builds/worker/workspace/build/src/layout/generic/nsIFrame.h:1997:46 in GetStateBits Shadow bytes around the buggy address: 0x0c4a80254c10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a80254c20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a80254c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a80254c40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a80254c50: 00 00 00 00 00 00 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 =>0x0c4a80254c60:[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c4a80254c70: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 00 00 00 00 00 00 0x0c4a80254c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a80254c90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a80254ca0: 00 00 00 00 00 00 00 00 f7 f7 f7 f7 f7 f7 f7 f7 0x0c4a80254cb0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==13578==ABORTING
Flags: in-testsuite?
Group: core-security → layout-core-security
NI a few people for initial investigation.
Flags: needinfo?(xidorn+moz)
Flags: needinfo?(emilio)
Flags: needinfo?(bzbarsky)
Priority: -- → P2
Testcase crashes opt-builds, too: bp-b7903603-c657-4252-b28c-8e5ac0171002 rbx in that crash looks like a framepoisoning address, likely not exploitable
Keywords: csectype-framepoisoning, sec-low
Based on the testcase, looks like the same issue as bug 1404324 to me: it's mutating a style rule to go back in-flow and has ::first-line involved.
Depends on: 1404324
Flags: needinfo?(bzbarsky)
Yup, looks the same.
Flags: needinfo?(emilio)
Flags: needinfo?(xidorn+moz)
Ok. Emilio, can you verify that your patch in bug 1404324 fixes this testcase, and if so, mark the dupe? Probably worth including this crashtest as well in your patches there.
Assignee: nobody → emilio
Flags: needinfo?(emilio)
Priority: P2 → P3
Yup, it's fixed by that patch, the test-case is really really similar, though I guess it doesn't hurt.
Status: NEW → RESOLVED
Closed: 7 years ago
Flags: needinfo?(emilio)
Resolution: --- → DUPLICATE
Group: layout-core-security
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: