Closed Bug 1429768 Opened 8 years ago Closed 8 years ago

Intermittent AddressSanitizer: heap-use-after-free /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:458:3 in memcpy

Categories

(Core :: WebRTC, defect)

Product:
Core
Component:
WebRTC
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla60
Tracking Flags:
Tracking Status
firefox-esr52 - wontfix
firefox58 --- wontfix
firefox59 + fixed
firefox60 + fixed

People

(Reporter: aryx, Assigned: bwc)

References

(Blocks 1 open bug)

Details

(Keywords: csectype-uaf, intermittent-failure, sec-high, Whiteboard: [post-critsmash-triage][adv-main59+])

Attachments

(2 files, 1 obsolete file)

Stop modifying mDescription on main
4.90 KB, patch
drno
: review+
abillings
: approval-mozilla-beta+
abillings
: sec-approval+
Details | Diff | Splinter Review
(esr52 backport) Stop modifying mDescription on main. r+drno
4.92 KB, patch
Details | Diff | Splinter Review
https://treeherder.mozilla.org/logviewer.html#?job_id=155631051&repo=mozilla-beta [task 2018-01-11T13:57:27.854Z] 13:57:27 INFO - GECKO(2979) | [Unnamed thread 0x61200012ba40]: I/signaling [|MediaPipeline] MediaPipeline.cpp:1823: MediaPipeline::NotifyDirectListenerUninstalled() listener=0x60c0003c0340 [task 2018-01-11T13:57:27.857Z] 13:57:27 INFO - GECKO(2979) | [Unnamed thread 0x61200012ba40]: I/signaling [|MediaPipeline] MediaPipeline.cpp:1816: MediaPipeline::NotifyDirectListenerInstalled() listener=0x60c0003c0340, result=4 [task 2018-01-11T13:57:27.862Z] 13:57:27 INFO - GECKO(2979) | [Unnamed thread 0x61200012ba40]: E/signaling [|WebrtcAudioSessionConduit] AudioConduit.cpp:753: A/V sync: sync delta: 0ms, audio jitter delay 173ms, playout delay 0ms [task 2018-01-11T13:57:28.047Z] 13:57:28 INFO - GECKO(2979) | [Unnamed thread 0x61200012ba40]: E/signaling [|WebrtcAudioSessionConduit] AudioConduit.cpp:753: A/V sync: sync delta: 0ms, audio jitter delay 175ms, playout delay 0ms [task 2018-01-11T13:57:28.197Z] 13:57:28 INFO - GECKO(2979) | ================================================================= [task 2018-01-11T13:57:28.200Z] 13:57:28 INFO - GECKO(2979) | [Main Thread]: I/signaling [main|WebrtcAudioSessionConduit] AudioConduit.cpp:262: SetDtmfPayloadType : setting dtmf payload 101 [task 2018-01-11T13:57:28.201Z] 13:57:28 ERROR - GECKO(2979) | ==3027==ERROR: AddressSanitizer: heap-use-after-free on address 0x606000afe578 at pc 0x0000004a63e0 bp 0x7f56d5b6ad10 sp 0x7f56d5b6a4b8 [task 2018-01-11T13:57:28.203Z] 13:57:28 INFO - GECKO(2979) | READ of size 2139095190 at 0x606000afe578 thread T10 (Socket Thread) [task 2018-01-11T13:57:28.269Z] 13:57:28 INFO - GECKO(2979) | [Unnamed thread 0x61200012ba40]: E/signaling [|WebrtcAudioSessionConduit] AudioConduit.cpp:753: A/V sync: sync delta: 0ms, audio jitter delay 174ms, playout delay 0ms [task 2018-01-11T13:57:28.492Z] 13:57:28 INFO - GECKO(2979) | #0 0x4a63df in memcpy /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:458:3 [task 2018-01-11T13:57:28.511Z] 13:57:28 INFO - GECKO(2979) | #1 0x7f573ca60c8f in std::string::_Rep::_M_clone(std::allocator<char> const&, unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xcfc8f) [task 2018-01-11T13:57:28.512Z] 13:57:28 INFO - GECKO(2979) | #2 0x7f573ca6136b in std::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string(std::string const&) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xd036b) [task 2018-01-11T13:57:28.993Z] 13:57:28 INFO - GECKO(2979) | #3 0x7f572020561b in mozilla::MediaPipeline::RtcpPacketReceived(mozilla::TransportLayer*, unsigned char const*, unsigned long) /builds/worker/workspace/build/src/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp:1194:67 [task 2018-01-11T13:57:28.996Z] 13:57:28 INFO - GECKO(2979) | #4 0x7f57203ddffd in operator() /builds/worker/workspace/build/src/media/mtransport/sigslot.h:2486:12 [task 2018-01-11T13:57:28.996Z] 13:57:28 INFO - GECKO(2979) | #5 0x7f57203ddffd in mozilla::TransportLayerIce::IcePacketReceived(mozilla::NrIceMediaStream*, int, unsigned char const*, int) /builds/worker/workspace/build/src/media/mtransport/transportlayerice.cpp:235 [task 2018-01-11T13:57:28.999Z] 13:57:28 INFO - GECKO(2979) | #6 0x7f572038e721 in operator() /builds/worker/workspace/build/src/media/mtransport/sigslot.h:2553:12 [task 2018-01-11T13:57:29.000Z] 13:57:28 INFO - GECKO(2979) | #7 0x7f572038e721 in mozilla::NrIceCtx::msg_recvd(void*, nr_ice_peer_ctx_*, nr_ice_media_stream_*, int, unsigned char*, int) /builds/worker/workspace/build/src/media/mtransport/nricectx.cpp:380 [task 2018-01-11T13:57:29.001Z] 13:57:29 INFO - GECKO(2979) | #8 0x7f57287f1075 in nr_ice_peer_ctx_deliver_packet_maybe /builds/worker/workspace/build/src/media/mtransport/third_party/nICEr/src/ice/ice_peer_ctx.c:837:7 [task 2018-01-11T13:57:29.002Z] 13:57:29 INFO - GECKO(2979) | #9 0x7f57287e613b in nr_ice_ctx_deliver_packet /builds/worker/workspace/build/src/media/mtransport/third_party/nICEr/src/ice/ice_ctx.c:948:9 [task 2018-01-11T13:57:29.003Z] 13:57:29 INFO - GECKO(2979) | #10 0x7f57287f22ec in nr_ice_socket_readable_cb /builds/worker/workspace/build/src/media/mtransport/third_party/nICEr/src/ice/ice_socket.c:191:7 [task 2018-01-11T13:57:29.003Z] 13:57:29 INFO - GECKO(2979) | #11 0x7f5720385822 in apply<RefPtr<mozilla::NrUdpSocketIpc>, void (mozilla::NrUdpSocketIpc::*)(RefPtr<mozilla::nr_udp_message>), RefPtr<mozilla::nr_udp_message> , 0> /builds/worker/workspace/build/src/media/mtransport/runnable_utils.h:104:5 [task 2018-01-11T13:57:29.004Z] 13:57:29 INFO - GECKO(2979) | #12 0x7f5720385822 in mozilla::runnable_args_memfn<RefPtr<mozilla::NrUdpSocketIpc>, void (mozilla::NrUdpSocketIpc::*)(RefPtr<mozilla::nr_udp_message>), RefPtr<mozilla::nr_udp_message> >::Run() /builds/worker/workspace/build/src/media/mtransport/runnable_utils.h:174 [task 2018-01-11T13:57:29.006Z] 13:57:29 INFO - GECKO(2979) | #13 0x7f571e878eb5 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 [task 2018-01-11T13:57:29.007Z] 13:57:29 INFO - GECKO(2979) | #14 0x7f571e891b08 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 [task 2018-01-11T13:57:29.024Z] 13:57:29 INFO - GECKO(2979) | #15 0x7f571ea90274 in mozilla::net::nsSocketTransportService::Run() /builds/worker/workspace/build/src/netwerk/base/nsSocketTransportService2.cpp:990:21 [task 2018-01-11T13:57:29.026Z] 13:57:29 INFO - GECKO(2979) | #16 0x7f571ea924cc in non-virtual thunk to mozilla::net::nsSocketTransportService::Run() /builds/worker/workspace/build/src/netwerk/base/nsSocketTransportService2.cpp:857:27 [task 2018-01-11T13:57:29.028Z] 13:57:29 INFO - GECKO(2979) | #17 0x7f571e878eb5 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 [task 2018-01-11T13:57:29.031Z] 13:57:29 INFO - GECKO(2979) | #18 0x7f571e891b08 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 [task 2018-01-11T13:57:29.033Z] 13:57:29 INFO - GECKO(2979) | #19 0x7f571f627b4d in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:334:20 [task 2018-01-11T13:57:29.034Z] 13:57:29 INFO - GECKO(2979) | #20 0x7f571f589beb in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10 [task 2018-01-11T13:57:29.035Z] 13:57:29 INFO - GECKO(2979) | #21 0x7f571f589beb in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319 [task 2018-01-11T13:57:29.037Z] 13:57:29 INFO - GECKO(2979) | #22 0x7f571f589beb in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299 [task 2018-01-11T13:57:29.039Z] 13:57:29 INFO - GECKO(2979) | #23 0x7f571e874c1c in nsThread::ThreadFunc(void*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:425:11 [task 2018-01-11T13:57:29.040Z] 13:57:29 INFO - GECKO(2979) | #24 0x7f57389d74d3 in _pt_root /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:216:5 [task 2018-01-11T13:57:29.041Z] 13:57:29 INFO - GECKO(2979) | #25 0x7f573cd1a6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9) [task 2018-01-11T13:57:29.104Z] 13:57:29 INFO - GECKO(2979) | #26 0x7f573bda33dc in clone /build/glibc-bfm8X4/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109 [task 2018-01-11T13:57:29.104Z] 13:57:29 INFO - GECKO(2979) | 0x606000afe599 is located 0 bytes to the right of 57-byte region [0x606000afe560,0x606000afe599) [task 2018-01-11T13:57:29.104Z] 13:57:29 INFO - GECKO(2979) | freed by thread T0 (Web Content) here: [task 2018-01-11T13:57:29.106Z] 13:57:29 INFO - GECKO(2979) | #0 0x4e9ddb in operator delete(void*) /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cc:110:3 [task 2018-01-11T13:57:29.107Z] 13:57:29 INFO - GECKO(2979) | #1 0x7f573ca60d86 in std::string::reserve(unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xcfd86) [task 2018-01-11T13:57:29.108Z] 13:57:29 INFO - GECKO(2979) | previously allocated by thread T0 (Web Content) here: [task 2018-01-11T13:57:29.109Z] 13:57:29 INFO - GECKO(2979) | #0 0x4e97db in operator new(unsigned long) /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cc:78:35 [task 2018-01-11T13:57:29.123Z] 13:57:29 INFO - GECKO(2979) | #1 0x7f573ca5fe38 in std::string::_Rep::_S_create(unsigned long, unsigned long, std::allocator<char> const&) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xcee38) [task 2018-01-11T13:57:29.124Z] 13:57:29 INFO - GECKO(2979) | Thread T10 (Socket Thread) created by T0 (Web Content) here: [task 2018-01-11T13:57:29.125Z] 13:57:29 INFO - GECKO(2979) | #0 0x4a4826 in __interceptor_pthread_create /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:245:3 [task 2018-01-11T13:57:29.131Z] 13:57:29 INFO - GECKO(2979) | #1 0x7f57389d4279 in _PR_CreateThread /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:457:14 [task 2018-01-11T13:57:29.132Z] 13:57:29 INFO - GECKO(2979) | #2 0x7f57389d3e8e in PR_CreateThread /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:548:12 [task 2018-01-11T13:57:29.132Z] 13:57:29 INFO - GECKO(2979) | #3 0x7f571e876431 in nsThread::Init(nsTSubstring<char> const&) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:598:8 [task 2018-01-11T13:57:29.133Z] 13:57:29 INFO - GECKO(2979) | #4 0x7f571e87d69f in nsThreadManager::NewNamedThread(nsTSubstring<char> const&, unsigned int, nsIThread**) /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:357:22 [task 2018-01-11T13:57:29.135Z] 13:57:29 INFO - GECKO(2979) | #5 0x7f571e88f8f3 in NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, nsIRunnable*, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:139:45 [task 2018-01-11T13:57:29.136Z] 13:57:29 INFO - GECKO(2979) | #6 0x7f571ea8d1dd in NS_NewNamedThread<14> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:72:10 [task 2018-01-11T13:57:29.141Z] 13:57:29 INFO - GECKO(2979) | #7 0x7f571ea8d1dd in mozilla::net::nsSocketTransportService::Init() /builds/worker/workspace/build/src/netwerk/base/nsSocketTransportService2.cpp:560 [task 2018-01-11T13:57:29.142Z] 13:57:29 INFO - GECKO(2979) | #8 0x7f571f5648ac in nsSocketTransportServiceConstructor(nsISupports*, nsID const&, void**) /builds/worker/workspace/build/src/netwerk/build/nsNetModule.cpp:80:1 [task 2018-01-11T13:57:29.150Z] 13:57:29 INFO - GECKO(2979) | #9 0x7f571e832861 in nsComponentManagerImpl::CreateInstanceByContractID(char const*, nsISupports*, nsID const&, void**) /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:1086:19 [task 2018-01-11T13:57:29.151Z] 13:57:29 INFO - GECKO(2979) | #10 0x7f571e829efb in nsComponentManagerImpl::GetServiceByContractID(char const*, nsID const&, void**) /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:1446:10 [task 2018-01-11T13:57:29.153Z] 13:57:29 INFO - GECKO(2979) | #11 0x7f571e83873a in CallGetService /builds/worker/workspace/build/src/xpcom/components/nsComponentManagerUtils.cpp:67:43 [task 2018-01-11T13:57:29.155Z] 13:57:29 INFO - GECKO(2979) | #12 0x7f571e83873a in nsGetServiceByContractIDWithError::operator()(nsID const&, void**) const /builds/worker/workspace/build/src/xpcom/components/nsComponentManagerUtils.cpp:292 [task 2018-01-11T13:57:29.157Z] 13:57:29 INFO - GECKO(2979) | #13 0x7f571e706270 in nsCOMPtr_base::assign_from_gs_contractid_with_error(nsGetServiceByContractIDWithError const&, nsID const&) /builds/worker/workspace/build/src/xpcom/base/nsCOMPtr.cpp:106:7 [task 2018-01-11T13:57:29.163Z] 13:57:29 INFO - GECKO(2979) | #14 0x7f571e9f5593 in operator= /builds/worker/workspace/build/src/obj-firefox/dist/include/nsCOMPtr.h:697:5 [task 2018-01-11T13:57:29.164Z] 13:57:29 INFO - GECKO(2979) | #15 0x7f571e9f5593 in InitializeSocketTransportService /builds/worker/workspace/build/src/netwerk/base/nsIOService.cpp:297 [task 2018-01-11T13:57:29.170Z] 13:57:29 INFO - GECKO(2979) | #16 0x7f571e9f5593 in mozilla::net::nsIOService::SetOffline(bool) /builds/worker/workspace/build/src/netwerk/base/nsIOService.cpp:1098 [task 2018-01-11T13:57:29.170Z] 13:57:29 INFO - GECKO(2979) | #17 0x7f571e9f464d in mozilla::net::nsIOService::Init() /builds/worker/workspace/build/src/netwerk/base/nsIOService.cpp:264:5 [task 2018-01-11T13:57:29.171Z] 13:57:29 INFO - GECKO(2979) | #18 0x7f571e9f6dec in mozilla::net::nsIOService::GetInstance() /builds/worker/workspace/build/src/netwerk/base/nsIOService.cpp:359:13 [task 2018-01-11T13:57:29.173Z] 13:57:29 INFO - GECKO(2979) | #19 0x7f571f564642 in nsIOServiceConstructor(nsISupports*, nsID const&, void**) /builds/worker/workspace/build/src/netwerk/build/nsNetModule.cpp:62:1 [task 2018-01-11T13:57:29.175Z] 13:57:29 INFO - GECKO(2979) | #20 0x7f571e832861 in nsComponentManagerImpl::CreateInstanceByContractID(char const*, nsISupports*, nsID const&, void**) /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:1086:19 [task 2018-01-11T13:57:29.176Z] 13:57:29 INFO - GECKO(2979) | #21 0x7f571e829efb in nsComponentManagerImpl::GetServiceByContractID(char const*, nsID const&, void**) /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:1446:10 [task 2018-01-11T13:57:29.183Z] 13:57:29 INFO - GECKO(2979) | #22 0x7f57204a92ba in CallGetService<nsIIOService> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsServiceManagerUtils.h:89:10 [task 2018-01-11T13:57:29.184Z] 13:57:29 INFO - GECKO(2979) | #23 0x7f57204a92ba in nsScriptSecurityManager::Init() /builds/worker/workspace/build/src/caps/nsScriptSecurityManager.cpp:1348 [task 2018-01-11T13:57:29.186Z] 13:57:29 INFO - GECKO(2979) | #24 0x7f57204a9e50 in nsScriptSecurityManager::InitStatics() /builds/worker/workspace/build/src/caps/nsScriptSecurityManager.cpp:1422:30 [task 2018-01-11T13:57:29.191Z] 13:57:29 INFO - GECKO(2979) | #25 0x7f5720008608 in nsXPConnect::InitStatics() /builds/worker/workspace/build/src/js/xpconnect/src/nsXPConnect.cpp:129:5 [task 2018-01-11T13:57:29.192Z] 13:57:29 INFO - GECKO(2979) | #26 0x7f571ff988e8 in xpcModuleCtor() /builds/worker/workspace/build/src/js/xpconnect/src/XPCModule.cpp:13:5 [task 2018-01-11T13:57:29.199Z] 13:57:29 INFO - GECKO(2979) | #27 0x7f572605d428 in Initialize() /builds/worker/workspace/build/src/layout/build/nsLayoutModule.cpp:316:8 [task 2018-01-11T13:57:29.202Z] 13:57:29 INFO - GECKO(2979) | #28 0x7f571e8314f8 in Load /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:763:21 [task 2018-01-11T13:57:29.204Z] 13:57:29 INFO - GECKO(2979) | #29 0x7f571e8314f8 in nsFactoryEntry::GetFactory() /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:1785 [task 2018-01-11T13:57:29.204Z] 13:57:29 INFO - GECKO(2979) | #30 0x7f571e8327fd in nsComponentManagerImpl::CreateInstanceByContractID(char const*, nsISupports*, nsID const&, void**) /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:1083:41 [task 2018-01-11T13:57:29.207Z] 13:57:29 INFO - GECKO(2979) | #31 0x7f571e83817d in CallCreateInstance /builds/worker/workspace/build/src/xpcom/components/nsComponentManagerUtils.cpp:149:38 [task 2018-01-11T13:57:29.209Z] 13:57:29 INFO - GECKO(2979) | #32 0x7f571e83817d in nsCreateInstanceByContractID::operator()(nsID const&, void**) const /builds/worker/workspace/build/src/xpcom/components/nsComponentManagerUtils.cpp:197 [task 2018-01-11T13:57:29.215Z] 13:57:29 INFO - GECKO(2979) | #33 0x7f571e7065f6 in nsCOMPtr_base::assign_from_helper(nsCOMPtr_helper const&, nsID const&) /builds/worker/workspace/build/src/xpcom/base/nsCOMPtr.cpp:128:7 [task 2018-01-11T13:57:29.217Z] 13:57:29 INFO - GECKO(2979) | #34 0x7f571e81bdb6 in nsCOMPtr /builds/worker/workspace/build/src/obj-firefox/dist/include/nsCOMPtr.h:605:5 [task 2018-01-11T13:57:29.217Z] 13:57:29 INFO - GECKO(2979) | #35 0x7f571e81bdb6 in LogMessageWithContext(mozilla::FileLocation&, unsigned int, char const*, ...) /builds/worker/workspace/build/src/xpcom/components/ManifestParser.cpp:190 [task 2018-01-11T13:57:29.219Z] 13:57:29 INFO - GECKO(2979) | #36 0x7f571e821f1e in nsComponentManagerImpl::ManifestContract(nsComponentManagerImpl::ManifestProcessingContext&, int, char* const*) /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:695:5 [task 2018-01-11T13:57:29.220Z] 13:57:29 INFO - GECKO(2979) | #37 0x7f571e81f53e in ParseManifest(NSLocationType, mozilla::FileLocation&, char*, bool, bool) /builds/worker/workspace/build/src/xpcom/components/ManifestParser.cpp:777:48 [task 2018-01-11T13:57:29.220Z] 13:57:29 INFO - GECKO(2979) | #38 0x7f571e82e136 in DoRegisterManifest /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:547:5 [task 2018-01-11T13:57:29.222Z] 13:57:29 INFO - GECKO(2979) | #39 0x7f571e82e136 in nsComponentManagerImpl::RegisterManifest(NSLocationType, mozilla::FileLocation&, bool) /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:560 [task 2018-01-11T13:57:29.224Z] 13:57:29 INFO - GECKO(2979) | #40 0x7f571e82e453 in nsComponentManagerImpl::ManifestManifest(nsComponentManagerImpl::ManifestProcessingContext&, int, char* const*) /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:569:3 [task 2018-01-11T13:57:29.225Z] 13:57:29 INFO - GECKO(2979) | #41 0x7f571e81f207 in ParseManifest(NSLocationType, mozilla::FileLocation&, char*, bool, bool) /builds/worker/workspace/build/src/xpcom/components/ManifestParser.cpp:769:9 [task 2018-01-11T13:57:29.229Z] 13:57:29 INFO - GECKO(2979) | #42 0x7f571e82e136 in DoRegisterManifest /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:547:5 [task 2018-01-11T13:57:29.231Z] 13:57:29 INFO - GECKO(2979) | #43 0x7f571e82e136 in nsComponentManagerImpl::RegisterManifest(NSLocationType, mozilla::FileLocation&, bool) /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:560 [task 2018-01-11T13:57:29.231Z] 13:57:29 INFO - GECKO(2979) | #44 0x7f571e82cbf9 in nsComponentManagerImpl::RereadChromeManifests(bool) /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:721:5 [task 2018-01-11T13:57:29.234Z] 13:57:29 INFO - GECKO(2979) | #45 0x7f571e82b543 in nsComponentManagerImpl::Init() /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:352:5 [task 2018-01-11T13:57:29.235Z] 13:57:29 INFO - GECKO(2979) | #46 0x7f571e8cbf36 in NS_InitXPCOM2 /builds/worker/workspace/build/src/xpcom/build/XPCOMInit.cpp:677:51 [task 2018-01-11T13:57:29.235Z] 13:57:29 INFO - GECKO(2979) | #47 0x7f57286eb0fe in XRE_InitEmbedding2(nsIFile*, nsIFile*, nsIDirectoryServiceProvider*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:187:8 [task 2018-01-11T13:57:29.236Z] 13:57:29 INFO - GECKO(2979) | #48 0x7f571f631254 in mozilla::ipc::ScopedXREEmbed::Start() /builds/worker/workspace/build/src/ipc/glue/ScopedXREEmbed.cpp:97:10 [task 2018-01-11T13:57:29.239Z] 13:57:29 INFO - GECKO(2979) | #49 0x7f572470e1cc in mozilla::dom::ContentProcess::Init(int, char**) /builds/worker/workspace/build/src/dom/ipc/ContentProcess.cpp:244:13 [task 2018-01-11T13:57:29.239Z] 13:57:29 INFO - GECKO(2979) | #50 0x7f57286ebb38 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:671:21 [task 2018-01-11T13:57:29.240Z] 13:57:29 INFO - GECKO(2979) | #51 0x4ec2de in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:63:30 [task 2018-01-11T13:57:29.241Z] 13:57:29 INFO - GECKO(2979) | #52 0x4ec2de in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:280 [task 2018-01-11T13:57:29.241Z] 13:57:29 INFO - GECKO(2979) | #53 0x7f573bcbc82f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291 [task 2018-01-11T13:57:29.246Z] 13:57:29 INFO - GECKO(2979) | SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:458:3 in memcpy [task 2018-01-11T13:57:29.247Z] 13:57:29 INFO - GECKO(2979) | Shadow bytes around the buggy address: [task 2018-01-11T13:57:29.248Z] 13:57:29 INFO - GECKO(2979) | 0x0c0c80157c50: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fa [task 2018-01-11T13:57:29.250Z] 13:57:29 INFO - GECKO(2979) | 0x0c0c80157c60: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa [task 2018-01-11T13:57:29.252Z] 13:57:29 INFO - GECKO(2979) | 0x0c0c80157c70: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd [task 2018-01-11T13:57:29.252Z] 13:57:29 INFO - GECKO(2979) | 0x0c0c80157c80: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fd [task 2018-01-11T13:57:29.253Z] 13:57:29 INFO - GECKO(2979) | 0x0c0c80157c90: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa [task 2018-01-11T13:57:29.254Z] 13:57:29 INFO - GECKO(2979) | =>0x0c0c80157ca0: 00 00 00 00 00 00 00 00 fa fa fa fa fd fd fd[fd] [task 2018-01-11T13:57:29.256Z] 13:57:29 INFO - GECKO(2979) | 0x0c0c80157cb0: fd fd fd fd fa fa fa fa 00 00 00 00 00 00 00 07 [task 2018-01-11T13:57:29.257Z] 13:57:29 INFO - GECKO(2979) | 0x0c0c80157cc0: fa fa fa fa 00 00 00 00 00 00 00 07 fa fa fa fa [task 2018-01-11T13:57:29.264Z] 13:57:29 INFO - GECKO(2979) | 0x0c0c80157cd0: 00 00 00 00 00 00 00 07 fa fa fa fa fd fd fd fd [task 2018-01-11T13:57:29.265Z] 13:57:29 INFO - GECKO(2979) | 0x0c0c80157ce0: fd fd fd fd fa fa fa fa 00 00 00 00 00 00 00 00 [task 2018-01-11T13:57:29.268Z] 13:57:29 INFO - GECKO(2979) | 0x0c0c80157cf0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa [task 2018-01-11T13:57:29.269Z] 13:57:29 INFO - GECKO(2979) | Shadow byte legend (one shadow byte represents 8 application bytes): [task 2018-01-11T13:57:29.269Z] 13:57:29 INFO - GECKO(2979) | Addressable: 00 [task 2018-01-11T13:57:29.269Z] 13:57:29 INFO - GECKO(2979) | Partially addressable: 01 02 03 04 05 06 07 [task 2018-01-11T13:57:29.271Z] 13:57:29 INFO - GECKO(2979) | Heap left redzone: fa [task 2018-01-11T13:57:29.273Z] 13:57:29 INFO - GECKO(2979) | Heap right redzone: fb [task 2018-01-11T13:57:29.274Z] 13:57:29 INFO - GECKO(2979) | Freed heap region: fd [task 2018-01-11T13:57:29.275Z] 13:57:29 INFO - GECKO(2979) | Stack left redzone: f1 [task 2018-01-11T13:57:29.276Z] 13:57:29 INFO - GECKO(2979) | Stack mid redzone: f2 [task 2018-01-11T13:57:29.280Z] 13:57:29 INFO - GECKO(2979) | Stack right redzone: f3 [task 2018-01-11T13:57:29.282Z] 13:57:29 INFO - GECKO(2979) | Stack partial redzone: f4 [task 2018-01-11T13:57:29.284Z] 13:57:29 INFO - GECKO(2979) | Stack after return: f5 [task 2018-01-11T13:57:29.285Z] 13:57:29 INFO - GECKO(2979) | Stack use after scope: f8 [task 2018-01-11T13:57:29.285Z] 13:57:29 INFO - GECKO(2979) | Global redzone: f9 [task 2018-01-11T13:57:29.288Z] 13:57:29 INFO - GECKO(2979) | Global init order: f6 [task 2018-01-11T13:57:29.288Z] 13:57:29 INFO - GECKO(2979) | Poisoned by user: f7 [task 2018-01-11T13:57:29.289Z] 13:57:29 INFO - GECKO(2979) | Container overflow: fc [task 2018-01-11T13:57:29.289Z] 13:57:29 INFO - GECKO(2979) | Array cookie: ac [task 2018-01-11T13:57:29.290Z] 13:57:29 INFO - GECKO(2979) | Intra object redzone: bb [task 2018-01-11T13:57:29.290Z] 13:57:29 INFO - GECKO(2979) | ASan internal: fe [task 2018-01-11T13:57:29.290Z] 13:57:29 INFO - GECKO(2979) | Left alloca redzone: ca [task 2018-01-11T13:57:29.292Z] 13:57:29 INFO - GECKO(2979) | Right alloca redzone: cb [task 2018-01-11T13:57:29.293Z] 13:57:29 INFO - GECKO(2979) | ==3027==ABORTING [task 2018-01-11T13:57:29.354Z] 13:57:29 INFO - GECKO(2979) | [Parent 2979, Gecko_IOThread] WARNING: pipe error (58): Connection reset by peer: file /builds/worker/workspace/build/src/ipc/chromium/src/chrome/common/ipc_channel_posix.cc, line 353 [task 2018-01-11T13:57:29.356Z] 13:57:29 INFO - GECKO(2979) | [Parent 2979, Gecko_IOThread] WARNING: pipe error (63): Connection reset by peer: file /builds/worker/workspace/build/src/ipc/chromium/src/chrome/common/ipc_channel_posix.cc, line 353 [task 2018-01-11T13:57:29.360Z] 13:57:29 INFO - GECKO(2979) | ###!!! [Parent][MessageChannel] Error: (msgtype=0x150084,name=PBrowser::Msg_Destroy) Channel error: cannot send/recv [task 2018-01-11T14:03:39.376Z] 14:03:39 INFO - Buffered messages logged at 13:57:16 [task 2018-01-11T14:03:39.380Z] 14:03:39 INFO - TEST-PASS | dom/media/tests/mochitest/test_peerConnection_replaceTrack.html | A valid string reason is expected
drno: looks like it was RtpLogger::LogPacket( innerData.get(), outLen, true, true, header.headerLength, mDescription); (beta) MediaPipeline.cpp:194
Flags: needinfo?(drno)
The last thing happening from a mochitest perspective was: [task 2018-01-11T14:03:40.044Z] 14:03:39 INFO - TEST-PASS | dom/media/tests/mochitest/test_peerConnection_replaceTrack.html | track exists among pc's local streams [task 2018-01-11T14:03:40.044Z] 14:03:39 INFO - Run step 52: PC_LOCAL_CHECK_WEBAUDIO_FLOW_PRESENT I don't see how this could be caused by code in the MediaPipeline itself. It looks like something freed the memory with the received packet in it (allocated on the STS thread). Byron, do you think new logic in Transceivers in regards to replaceTrack could free things which are still being processed?
Flags: needinfo?(drno) → needinfo?(docfaraday)
Ok, so this crash is happening here: https://hg.mozilla.org/releases/mozilla-beta/file/8bb8f895a740/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp#l1194 I bet the problem here is not the packet data, but |description_|, and looking at the source I bet it was yanked out from under us by replaceTrack, which it turns out is the test being run.
Flags: needinfo?(docfaraday)
This bug seems to go back to esr52 at least.
The right thing to be doing here, probably, is dispatching the update to |description_| to the STS thread. That sound sensible to you?
Flags: needinfo?(drno)
Assignee: nobody → docfaraday
(In reply to Byron Campen [:bwc] from comment #5) > The right thing to be doing here, probably, is dispatching the update to > |description_| to the STS thread. > > That sound sensible to you? Yes that sounds like the right solution (even though more thread dispatches don't make the world a better place).
Flags: needinfo?(drno)
Attachment #8949373 - Flags: review?(drno)
Comment on attachment 8949373 [details] [diff] [review] Stop modifying mDescription on main Review of attachment 8949373 [details] [diff] [review]: ----------------------------------------------------------------- Just one clarifying question, but otherwise LGTM ::: media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp @@ +1498,5 @@ > std::string trackId(NS_ConvertUTF16toUTF8(nsTrackId).get()); > + description += trackId; > + description += "]"; > + > + RUN_ON_THREAD( Do we want to use RUN_ON_THREAD here, or should we dispatch directly (I'm assuming this is rather urgent and should not wait for other things to finish)?
Attachment #8949373 - Flags: review?(drno) → review+
(In reply to Nils Ohlmeier [:drno] from comment #9) > Comment on attachment 8949373 [details] [diff] [review] > Stop modifying mDescription on main > > Review of attachment 8949373 [details] [diff] [review]: > ----------------------------------------------------------------- > > Just one clarifying question, but otherwise LGTM > > ::: media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp > @@ +1498,5 @@ > > std::string trackId(NS_ConvertUTF16toUTF8(nsTrackId).get()); > > + description += trackId; > > + description += "]"; > > + > > + RUN_ON_THREAD( > > Do we want to use RUN_ON_THREAD here, or should we dispatch directly (I'm > assuming this is rather urgent and should not wait for other things to > finish)? I'm just using RUN_ON_THREAD because that's what this file uses. RUN_ON_THREAD does not queue jump anymore.
Comment on attachment 8949373 [details] [diff] [review] Stop modifying mDescription on main [Security approval request comment] How easily could an exploit be constructed based on the patch? Probably pretty hard. The window of opportunity on this race is _extremely_ tight, and if we do hit it, we just read random memory as a string, and log it if we're configured to (we aren't by default). The attacker would need to have some access to the logging system to really take advantage of this. Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem? Kinda. But it seems hard to exploit. Which older supported branches are affected by this flaw? All. Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be? No. They should be relatively easy though. How likely is this patch to cause regressions; how much testing does it need? Pretty unlikely.
Attachment #8949373 - Flags: sec-approval?
sec-approval+ for trunk. I'd like to get beta (59) and ESR52 patches nominated to go in once trunk lands.
status-firefox58: --- → wontfix
status-firefox59: --- → affected
status-firefox60: --- → affected
status-firefox-esr52: --- → affected
tracking-firefox59: --- → +
tracking-firefox60: --- → +
tracking-firefox-esr52: --- → 59+
Attachment #8949373 - Flags: sec-approval? → sec-approval+
Following up on uplifts Monday.
Flags: needinfo?(docfaraday)
https://hg.mozilla.org/mozilla-central/rev/e0d665bc6780
Status: NEW → RESOLVED
Closed: 8 years ago
status-firefox60: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla60
Attachment #8949373 - Attachment filename: . → update_description_sts.patch
Flags: needinfo?(docfaraday)
Attachment #8950356 - Attachment is obsolete: true
Comment on attachment 8949373 [details] [diff] [review] Stop modifying mDescription on main Approval Request Comment [Feature/Bug causing the regression]: This bug has been around long enough that it probably doesn't matter. [User impact if declined]: Extremely rare crashes on webrtc services that use replaceTrack while media is flowing. [Is this code covered by automated tests?]: Yes, but crash rate is extremely rare. [Has the fix been verified in Nightly?]: It looks fine. [Needs manual test from QE? If yes, steps to reproduce]: No. [List of other uplifts needed for the feature/fix]: None. [Is the change risky?]: Not very. [Why is the change risky/not risky?]: There is some chance that this patch will lengthen the lifetime of MediaPipelines, which could expose other bugs. It could also increase the frequency of MediaPipelines being destroyed on STS instead of main, which could expose other bugs also. [String changes made/needed]: None.
Attachment #8949373 - Flags: approval-mozilla-beta?
What do you think about uplifting to esr52? I wonder if we should hold off on that, because this is an extremely rare and probably safe crash, and any fix is going to alter the lifecycle of MediaPipeline.
Flags: needinfo?(drno)
Attachment #8949373 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
(In reply to Byron Campen [:bwc] from comment #19) > What do you think about uplifting to esr52? I wonder if we should hold off > on that, because this is an extremely rare and probably safe crash, and any > fix is going to alter the lifecycle of MediaPipeline. If it is rare I would not uplift it, given the remaining life time of ESR52. But how do you know how often it crashes? If I search for mozilla::MediaPipeline::RtcpPacketReceived on crash-stats I actually see quite a bit of crashes. But it seems we are chasing multiple crashes in that function, and another fix reduced the amount of crashes since the beginning of February. Are you looking for another crash signature?
Flags: needinfo?(drno) → needinfo?(docfaraday)
(In reply to Nils Ohlmeier [:drno] from comment #20) > (In reply to Byron Campen [:bwc] from comment #19) > > What do you think about uplifting to esr52? I wonder if we should hold off > > on that, because this is an extremely rare and probably safe crash, and any > > fix is going to alter the lifecycle of MediaPipeline. > > If it is rare I would not uplift it, given the remaining life time of ESR52. > > But how do you know how often it crashes? > If I search for mozilla::MediaPipeline::RtcpPacketReceived on crash-stats I > actually see quite a bit of crashes. But it seems we are chasing multiple > crashes in that function, and another fix reduced the amount of crashes > since the beginning of February. Are you looking for another crash signature? I don't see a single crash like this on esr52, and that's not too surprising, given that all of the places we use |description_| are wrapped in log-level checks in 52 (because the RTP logger was added in 55).
status-firefox-esr52: affected → wontfix
Flags: needinfo?(docfaraday)
I agree about won't fixing this for ESR52.
Group: media-core-security → core-security-release
Flags: qe-verify-
Whiteboard: [post-critsmash-triage]
Whiteboard: [post-critsmash-triage] → [post-critsmash-triage][adv-main59+]
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: