1412511 - Crash in sftk_GetContext

Status: RESOLVED WONTFIX

(Core :: Security: PSM, defect, P2)

Description

[baffclan]

This bug was filed from the Socorro interface and is 
report bp-550a7537-d024-4e89-b646-596ad0171028,
       bp-0234df18-5851-41a5-a8fb-781e00171028.
=============================================================

Crashing Thread (48), Name: URL Classifier
Frame 	Module 	Signature 	Source
0 	softokn3.dll 	sftk_GetContext 	security/nss/lib/softoken/pkcs11c.c:416
1 	softokn3.dll 	NSC_DigestUpdate 	security/nss/lib/softoken/pkcs11c.c:1791
2 	nss3.dll 	PK11_DigestOp 	security/nss/lib/pk11wrap/pk11cxt.c:783
3 	xul.dll 	nsCryptoHash::Update(unsigned char const*, unsigned int) 	security/manager/ssl/nsCryptoHash.cpp:148
4 	xul.dll 	mozilla::safebrowsing::LookupCacheV4::VerifyChecksum(nsTSubstring<char> const&) 	toolkit/components/url-classifier/LookupCacheV4.cpp:384
5 	xul.dll 	mozilla::safebrowsing::LookupCacheV4::LoadFromFile(nsIFile*) 	toolkit/components/url-classifier/LookupCacheV4.cpp:174
6 	xul.dll 	mozilla::safebrowsing::LookupCache::LoadPrefixSet() 	toolkit/components/url-classifier/LookupCache.cpp:478
7 	xul.dll 	mozilla::safebrowsing::LookupCache::Open() 	toolkit/components/url-classifier/LookupCache.cpp:83
8 	xul.dll 	mozilla::safebrowsing::Classifier::GetLookupCache(nsTSubstring<char> const&, bool) 	toolkit/components/url-classifier/Classifier.cpp:1462
9 	xul.dll 	mozilla::safebrowsing::Classifier::RegenActiveTables() 	toolkit/components/url-classifier/Classifier.cpp:925
10 	xul.dll 	mozilla::safebrowsing::Classifier::Open(nsIFile&) 	toolkit/components/url-classifier/Classifier.cpp:262
11 	xul.dll 	nsUrlClassifierDBServiceWorker::OpenDb() 	toolkit/components/url-classifier/nsUrlClassifierDBService.cpp:947
12 	xul.dll 	mozilla::detail::RunnableMethodImpl<RefPtr<nsUrlClassifierDBServiceWorker>, void ( nsUrlClassifierDBServiceWorker::*)(void), 1, 0>::Run() 	xpcom/threads/nsThreadUtils.h:1192
13 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1039
14 	xul.dll 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/threads/nsThreadUtils.cpp:521
15 	xul.dll 	mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:368
16 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:319
17 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:299
18 	xul.dll 	nsThread::ThreadFunc(void*) 	xpcom/threads/nsThread.cpp:427
19 	nss3.dll 	PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c:397
20 	nss3.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c:95
21 	ucrtbase.dll 	thread_start<unsigned int (__cdecl*)(void* __ptr64)> 	
22 	kernel32.dll 	BaseThreadInitThunk 	
23 	ntdll.dll 	RtlUserThreadStart 	


Application Basics: 
Name: Firefox
Version:57.0b12
Build ID: 20171026211016
Update Channel: beta
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
OS: Windows_NT 10.0

Comment 1

[Dana Keeler (she/her) [:keeler]]

This may end up being an nss bug. At first glance it's unclear what could be wrong here - maybe there's some context corruption/uaf in softoken?

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.