1440783 - Use-after-free in AppendToLibPath

Status: RESOLVED FIXED

(Toolkit :: Application Update, defect)

Description

[Markus Stange [:mstange]]

The UniquePtr returned by Smprintf is not kept alive for long enough.

This was causing crashes in bug 1439118. For some reason these crashes only started happening after an unrelated patch landed (bug 1437428). (It looks like bug 1437428 affects a profiler test which runs in an xpcshell process at the same time as marAppApplyUpdateStageOldVersionFailure.js runs in a different xpcshell process, but it's unclear to me how this could affect things.)

Here's a green try push with the patch:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=04c01f9e6953643ef1ddfc0d1610d5c920f8002a

Here's what the revision this push was based on looked like without the patch:
https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=b915e160a690eb75d647c3681682064f87869f10&filter-searchStr=linux%20debug%20xpcshell

Comment 1

[Markus Stange [:mstange]]

Attachment: patch

Comment 2

[Arthur Edelstein [:arthur]]

Thanks for reporting this and proposing a fix. I have put in a request to temporarily back out the offending patch from bug 1434666 so I can test it more carefully. I will incorporate your UAF fix in the new version.

Comment 3

[Markus Stange [:mstange]]

Thanks.

Fixed by backout of bug 1434666.