1414065 - UBSan: null pointer passed as argument 1, which is declared to never be null [@ mozilla::image::fill_input_buffer]

Status: RESOLVED FIXED

(Core :: Graphics: ImageLib, defect, P3)

Description

[Tyson Smith [:tsmith] (Back Aug 12)]

Attachment: test_case.jpg

This error is triggered on startup when Firefox is built with: -fsanitize=nonnull-attribute

Looks like a null pointer is being passed to memmove()
> https://dxr.mozilla.org/mozilla-central/source/image/decoders/nsJPEGDecoder.cpp#919

/mozilla-central/image/decoders/nsJPEGDecoder.cpp:919:11: runtime error: null pointer passed as argument 1, which is declared to never be null
/usr/include/string.h:47:14: note: nonnull attribute specified here
    #0 0x7f06e5f3de31 in mozilla::image::fill_input_buffer(jpeg_decompress_struct*) /mozilla-central/image/decoders/nsJPEGDecoder.cpp:919:3
    #1 0x7f06eae00c48 in save_marker /mozilla-central/media/libjpeg/jdmarker.c:809:5
    #2 0x7f06eadf6472 in read_markers /mozilla-central/media/libjpeg/jdmarker.c:1075:13
    #3 0x7f06eade8bcb in consume_markers /mozilla-central/media/libjpeg/jdinput.c:320:9
    #4 0x7f06eadb3f5a in jpeg_finish_decompress /mozilla-central/media/libjpeg/jdapimin.c:399:9
    #5 0x7f06e5f42245 in mozilla::image::nsJPEGDecoder::ReadJPEGData(char const*, unsigned long) /mozilla-central/image/decoders/nsJPEGDecoder.cpp:543:9
    #6 0x7f06e5f500a9 in operator() /mozilla-central/image/decoders/nsJPEGDecoder.cpp:195:16
    #7 0x7f06e5f500a9 in mozilla::Maybe<mozilla::Variant<mozilla::image::TerminalState, mozilla::image::Yield> > mozilla::image::StreamingLexer<mozilla::image::nsJPEGDecoder::State, 16ul>::ContinueUnbufferedRead<mozilla::image::nsJPEGDecoder::DoDecode(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*)::$_7>(char const*, unsigned long, unsigned long, mozilla::image::nsJPEGDecoder::DoDecode(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*)::$_7) /mozilla-central/image/StreamingLexer.h:598
    #8 0x7f06e5f3f5ba in UnbufferedRead<(lambda at /mozilla-central/image/decoders/nsJPEGDecoder.cpp:192:21)> /mozilla-central/image/StreamingLexer.h:542:12
    #9 0x7f06e5f3f5ba in mozilla::Variant<mozilla::image::TerminalState, mozilla::image::Yield> mozilla::image::StreamingLexer<mozilla::image::nsJPEGDecoder::State, 16ul>::Lex<mozilla::image::nsJPEGDecoder::DoDecode(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*)::$_7>(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*, mozilla::image::nsJPEGDecoder::DoDecode(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*)::$_7) /mozilla-central/image/StreamingLexer.h:510
    #10 0x7f06e5f3e8d3 in mozilla::image::nsJPEGDecoder::DoDecode(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*) /mozilla-central/image/decoders/nsJPEGDecoder.cpp:191:17
    #11 0x7f06e5e3613f in mozilla::image::Decoder::Decode(mozilla::image::IResumable*) /mozilla-central/image/Decoder.cpp:130:20
    #12 0x7f06e5e40894 in mozilla::image::DecodedSurfaceProvider::Run() /mozilla-central/image/DecodedSurfaceProvider.cpp:139:34
    #13 0x7f06e5e6cbf0 in mozilla::image::DecodePoolWorker::Run() /mozilla-central/image/DecodePool.cpp:178:23
    #14 0x7f06e2c1df7f in nsThread::ProcessNextEvent(bool, bool*) /mozilla-central/xpcom/threads/nsThread.cpp:1037:14
    #15 0x7f06e2c4fb09 in NS_ProcessNextEvent(nsIThread*, bool) /mozilla-central/xpcom/threads/nsThreadUtils.cpp:513:10
    #16 0x7f06e3dde7e8 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /mozilla-central/ipc/glue/MessagePump.cpp:334:20
    #17 0x7f06e3c6b589 in RunHandler /mozilla-central/ipc/chromium/src/base/message_loop.cc:319:3
    #18 0x7f06e3c6b589 in MessageLoop::Run() /mozilla-central/ipc/chromium/src/base/message_loop.cc:299
    #19 0x7f06e2c18f91 in nsThread::ThreadFunc(void*) /mozilla-central/xpcom/threads/nsThread.cpp:425:11
    #20 0x7f070f55a30a in _pt_root /mozilla-central/nsprpub/pr/src/pthreads/ptthread.c:216:5
    #21 0x7f0712a137fb in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x77fb)
    #22 0x7f0711a41b0e in clone /build/glibc-CxtIbX/glibc-2.26/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /mozilla-central/image/decoders/nsJPEGDecoder.cpp:919:11 in

Comment 1

[Tyson Smith [:tsmith] (Back Aug 12)]

This is *not* triggered on startup it requires the attached test case (copy/paste error sorry).

Comment 2

[Tyson Smith [:tsmith] (Back Aug 12)]

This is hit by regular web surfing, cnn.com is an example of where this can be triggered.

Comment 3

[Andrew Osmond [:aosmond] (he/him)]

The only way that this can happen is if there was, in truth, no data to move and hence it never allocated a buffer in the first place. I reproduced and confirmed that src->bytes_in_buffer, decoder->mBackBufferLen, and decoder->mBackBufferSize were all zero as I suspected, as was decoder->mBackBufferUnreadLen. So it should be harmless. My only concern is if there are cases where decoder->mBackBufferUnreadLen is somehow not zero (that a would be a different bug though).

Comment 4

[Andrew Osmond [:aosmond] (he/him)]

Attachment: 0001-Bug-1414065-Ensure-nsJPEGDecoder-fill_input_buffer-a.patch

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/b2b7f05f3372
Ensure nsJPEGDecoder::fill_input_buffer avoids memmove calls with nullptr and zero length. r=tnikkel

Comment 6

[Tiberius Oros[:tiberius_oros]]

https://hg.mozilla.org/mozilla-central/rev/b2b7f05f3372

Comment 7

[Julien Cristau [:jcristau] (back August 18)]

wontfix for 58 based on comment 3's "should be harmless".