Closed Bug 1432679 Opened 7 years ago Closed 7 years ago

UBSan: signed integer overflow in [@ mozilla::image::nsGIFDecoder2::FinishImageDescriptor]

Categories

(Core :: Graphics: ImageLib, defect)

60 Branch
defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla60
Tracking Status
firefox60 --- fixed

People

(Reporter: tsmith, Assigned: tnikkel)

References

(Blocks 1 open bug)

Details

(Keywords: csectype-undefined, testcase, Whiteboard: [gfx-noted])

Attachments

(2 files)

Attached image testcase.gif
Found with changeset: 400421:c5461973d6ee Built with -fsanitize=signed-integer-overflow /image/decoders/nsGIFDecoder2.cpp:883:51: runtime error: signed integer overflow: 65535 * 65535 cannot be represented in type 'int' #0 0x7fc95c26ef96 in mozilla::image::nsGIFDecoder2::FinishImageDescriptor(char const*) /image/decoders/nsGIFDecoder2.cpp:883:51 #1 0x7fc95c26df7e in mozilla::image::nsGIFDecoder2::ReadImageDescriptor(char const*) /image/decoders/nsGIFDecoder2.cpp:770:12 #2 0x7fc95c289270 in mozilla::image::nsGIFDecoder2::DoDecode(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*)::$_1::operator()(mozilla::image::nsGIFDecoder2::State, char const*, unsigned long) const /image/decoders/nsGIFDecoder2.cpp:489:16 #3 0x7fc95c288a7d in mozilla::Maybe<mozilla::Variant<mozilla::image::TerminalState, mozilla::image::Yield> > mozilla::image::StreamingLexer<mozilla::image::nsGIFDecoder2::State, 16ul>::BufferedRead<mozilla::image::nsGIFDecoder2::DoDecode(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*)::$_1>(mozilla::image::SourceBufferIterator&, mozilla::image::nsGIFDecoder2::DoDecode(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*)::$_1) /image/StreamingLexer.h:649:28 #4 0x7fc95c26b4f2 in mozilla::Variant<mozilla::image::TerminalState, mozilla::image::Yield> mozilla::image::StreamingLexer<mozilla::image::nsGIFDecoder2::State, 16ul>::Lex<mozilla::image::nsGIFDecoder2::DoDecode(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*)::$_1>(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*, mozilla::image::nsGIFDecoder2::DoDecode(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*)::$_1) /image/StreamingLexer.h:512:20 #5 0x7fc95c26afc3 in mozilla::image::nsGIFDecoder2::DoDecode(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*) /image/decoders/nsGIFDecoder2.cpp:465:17 #6 0x7fc95c16f102 in mozilla::image::Decoder::Decode(mozilla::image::IResumable*) /image/Decoder.cpp:133:20 #7 0x7fc95c17825a in mozilla::image::DecodedSurfaceProvider::Run() /image/DecodedSurfaceProvider.cpp:139:34 #8 0x7fc95c177136 in mozilla::image::DecodePool::SyncRunIfPreferred(mozilla::image::IDecodingTask*, nsTString<char> const&) /image/DecodePool.cpp:326:12 #9 0x7fc95c1cb3d9 in mozilla::image::LaunchDecodingTask(mozilla::image::IDecodingTask*, mozilla::image::RasterImage*, unsigned int, bool) /image/RasterImage.cpp:1189:39 #10 0x7fc95c1c4a18 in mozilla::image::RasterImage::Decode(mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&, unsigned int, mozilla::image::PlaybackType) /image/RasterImage.cpp:1278:10 #11 0x7fc95c1c3d92 in mozilla::image::RasterImage::LookupFrame(mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&, unsigned int, mozilla::image::PlaybackType) /image/RasterImage.cpp:374:20 #12 0x7fc95c1cc554 in mozilla::image::RasterImage::Draw(gfxContext*, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&, mozilla::image::ImageRegion const&, unsigned int, mozilla::gfx::SamplingFilter, mozilla::Maybe<mozilla::SVGImageContext> const&, unsigned int, float) /image/RasterImage.cpp:1464:5 #13 0x7fc9609e98bb in DrawImageInternal(gfxContext&, nsPresContext*, imgIContainer*, mozilla::gfx::SamplingFilter, nsRect const&, nsRect const&, nsPoint const&, nsRect const&, mozilla::Maybe<mozilla::SVGImageContext> const&, unsigned int, mozilla::gfx::ExtendMode, float) /layout/base/nsLayoutUtils.cpp:6976:22 #14 0x7fc9609ea061 in nsLayoutUtils::DrawSingleImage(gfxContext&, nsPresContext*, imgIContainer*, mozilla::gfx::SamplingFilter, nsRect const&, nsRect const&, mozilla::Maybe<mozilla::SVGImageContext> const&, unsigned int, nsPoint const*, nsRect const*) /layout/base/nsLayoutUtils.cpp:7071:10 #15 0x7fc960f291f0 in nsImageBoxFrame::PaintImage(gfxContext&, nsRect const&, nsPoint, unsigned int) /layout/xul/nsImageBoxFrame.cpp:416:10 #16 0x7fc960f29c4f in nsDisplayXULImage::Paint(nsDisplayListBuilder*, gfxContext*) /layout/xul/nsImageBoxFrame.cpp:544:5 #17 0x7fc9610f5e78 in mozilla::FrameLayerBuilder::PaintItems(nsTArray<mozilla::FrameLayerBuilder::ClippedDisplayItem>&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, gfxContext*, nsDisplayListBuilder*, nsPresContext*, mozilla::gfx::IntPointTyped<mozilla::gfx::UnknownUnits> const&, float, float, int) /layout/painting/FrameLayerBuilder.cpp:6029:21 #18 0x7fc9610f6f07 in mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*) /layout/painting/FrameLayerBuilder.cpp:6190:19 #19 0x7fc95bc61fb4 in mozilla::layers::ClientPaintedLayer::PaintThebes(nsTArray<mozilla::layers::ReadbackProcessor::Update>*) /gfx/layers/client/ClientPaintedLayer.cpp:158:5 #20 0x7fc95bc63a62 in mozilla::layers::ClientPaintedLayer::RenderLayerWithReadback(mozilla::layers::ReadbackProcessor*) /gfx/layers/client/ClientPaintedLayer.cpp:314:3 #21 0x7fc95bcab020 in mozilla::layers::ClientContainerLayer::RenderLayer() /gfx/layers/client/ClientContainerLayer.h:58:29 #22 0x7fc95bc5ce03 in mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) /gfx/layers/client/ClientLayerManager.cpp:359:13 #23 0x7fc95bc5d6df in mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) /gfx/layers/client/ClientLayerManager.cpp:423:3 #24 0x7fc96115db19 in nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int) /layout/painting/nsDisplayList.cpp:2632:17 #25 0x7fc9609d9ad1 in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /layout/base/nsLayoutUtils.cpp:3976:12 #26 0x7fc9608f459a in mozilla::PresShell::Paint(nsView*, nsRegion const&, unsigned int) /layout/base/PresShell.cpp:6476:5 #27 0x7fc96017d87b in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /view/nsViewManager.cpp:480:19 #28 0x7fc96017cf5d in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /view/nsViewManager.cpp:412:33 #29 0x7fc96017f3eb in nsViewManager::ProcessPendingUpdates() /view/nsViewManager.cpp:1102:5 #30 0x7fc96086e1fc in nsRefreshDriver::Tick(long, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:2046:11 #31 0x7fc960879167 in mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /layout/base/nsRefreshDriver.cpp:306:7 #32 0x7fc960878e7c in mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:328:5 #33 0x7fc96087d937 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:769:5 #34 0x7fc96087c2e0 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:682:35 #35 0x7fc960877238 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() /layout/base/nsRefreshDriver.cpp:528:20 #36 0x7fc958b7a431 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1040:14 #37 0x7fc958bb5cfa in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:517:10 #38 0x7fc959f04131 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:97:21 #39 0x7fc959d64fe0 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:299:3 #40 0x7fc960215005 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:157:27 #41 0x7fc9661137b7 in nsAppStartup::Run() /toolkit/components/startup/nsAppStartup.cpp:288:30 #42 0x7fc9662eac38 in XREMain::XRE_mainRun() /toolkit/xre/nsAppRunner.cpp:4707:22 #43 0x7fc9662ecaef in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /toolkit/xre/nsAppRunner.cpp:4842:8 #44 0x7fc9662ed961 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /toolkit/xre/nsAppRunner.cpp:4934:21 #45 0x51855e in do_main(int, char**, char**) /browser/app/nsBrowserApp.cpp:231:22 #46 0x517d44 in main /browser/app/nsBrowserApp.cpp:304:16 #47 0x7fc99106f1c0 in __libc_start_main /build/glibc-itYbWN/glibc-2.26/csu/../csu/libc-start.c:308 #48 0x4207a9 in _start (/objdir-ff-ubsan/dist/bin/firefox+0x4207a9)
:aosmond, can you comment to the bug?
Flags: needinfo?(aosmond)
Whiteboard: [gfx-noted]
Attached patch gifint64Splinter Review
Assignee: nobody → tnikkel
Attachment #8948065 - Flags: review?(aosmond)
Flags: needinfo?(aosmond)
Attachment #8948065 - Flags: review?(aosmond) → review+
Pushed by tnikkel@gmail.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/3509bf5962d1 Do multiplication in nsGIFDecoder2::FinishImageDescriptor as int64_t to avoid overflow. r=aosmond
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla60
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: