Closed Bug 1454133 Opened 3 years ago Closed 3 years ago

heap-buffer-overflow in [@ NonMappedAttrCount]

Categories

(Core :: DOM: Editor, defect)

defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 1454126
Tracking Status
firefox61 --- affected

People

(Reporter: tsmith, Unassigned)

References

(Blocks 1 open bug)

Details

(4 keywords)

Attachments

(1 file)

Attached file testcase.html
==86815==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000c19fd0 at pc 0x7ff80132780b bp 0x7ffd8b3942c0 sp 0x7ffd8b3942b8
READ of size 8 at 0x603000c19fd0 thread T0
    #0 0x7ff80132780a in NonMappedAttrCount src/dom/base/nsAttrAndChildArray.cpp:714:24
    #1 0x7ff80132780a in nsAttrAndChildArray::AttrCount() const src/dom/base/nsAttrAndChildArray.cpp:296
    #2 0x7ff80124d261 in mozilla::dom::FragmentOrElement::cycleCollection::TraverseNative(void*, nsCycleCollectionTraversalCallback&) src/dom/base/FragmentOrElement.cpp:2029:45
    #3 0x7ff7fe16d7be in TraverseNativeAndJS src/xpcom/base/nsCycleCollectionParticipant.h:133:19
    #4 0x7ff7fe16d7be in CCGraphBuilder::BuildGraph(js::SliceBudget&) src/xpcom/base/nsCycleCollector.cpp:2336
    #5 0x7ff7fe17555e in nsCycleCollector::MarkRoots(js::SliceBudget&) src/xpcom/base/nsCycleCollector.cpp:2957:33
    #6 0x7ff7fe17c47c in nsCycleCollector::Collect(ccType, js::SliceBudget&, nsICycleCollectorListener*, bool) src/xpcom/base/nsCycleCollector.cpp:3750:9
    #7 0x7ff7fe180032 in nsCycleCollector_collect(nsICycleCollectorListener*) src/xpcom/base/nsCycleCollector.cpp:4315:21
    #8 0x7ff8014eebde in nsJSContext::CycleCollectNow(nsICycleCollectorListener*) src/dom/base/nsJSEnvironment.cpp:1488:3
    #9 0x7ff80106730b in nsDOMWindowUtils::CycleCollect(nsICycleCollectorListener*) src/dom/base/nsDOMWindowUtils.cpp:1271:3
    #10 0x7ff7fe3148a1 in NS_InvokeByIndex src/xpcom/reflect/xptcall/md/unix/xptcinvoke_asm_x86_64_unix.S:106
    #11 0x7ff7ffbb244e in Invoke src/js/xpconnect/src/XPCWrappedNative.cpp:1951:12
    #12 0x7ff7ffbb244e in Call src/js/xpconnect/src/XPCWrappedNative.cpp:1267
    #13 0x7ff7ffbb244e in XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) src/js/xpconnect/src/XPCWrappedNative.cpp:1234
    #14 0x7ff7ffbb90e8 in XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) src/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:911:12
    #15 0x7ff80a13aad7 in CallJSNative src/js/src/vm/JSContext-inl.h:290:15
    #16 0x7ff80a13aad7 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:467
    #17 0x7ff80a1255cb in CallFromStack src/js/src/vm/Interpreter.cpp:522:12
    #18 0x7ff80a1255cb in Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3084
    #19 0x7ff80a10bcc7 in js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:417:12
    #20 0x7ff80a13a855 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:489:15
    #21 0x7ff80a13bad2 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) src/js/src/vm/Interpreter.cpp:535:10
    #22 0x7ff80ac2b5cd in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/jsapi.cpp:2977:12
    #23 0x7ff7ffadbfbc in xpc::FunctionForwarder(JSContext*, unsigned int, JS::Value*) src/js/xpconnect/src/ExportHelpers.cpp:319:18
    #24 0x7ff80a13aad7 in CallJSNative src/js/src/vm/JSContext-inl.h:290:15
    #25 0x7ff80a13aad7 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:467
    #26 0x7ff80a1255cb in CallFromStack src/js/src/vm/Interpreter.cpp:522:12
    #27 0x7ff80a1255cb in Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3084
    #28 0x7ff80a10bcc7 in js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:417:12
    #29 0x7ff80a13a855 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:489:15
    #30 0x7ff80a13bad2 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) src/js/src/vm/Interpreter.cpp:535:10
    #31 0x7ff80ac2b5cd in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/jsapi.cpp:2977:12
    #32 0x7ff8030216ef in mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) src/obj-firefox/dom/bindings/EventListenerBinding.cpp:51:8
    #33 0x7ff803fbc9f1 in HandleEvent<mozilla::dom::EventTarget *> src/obj-firefox/dist/include/mozilla/dom/EventListenerBinding.h:66:12
    #34 0x7ff803fbc9f1 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1118
    #35 0x7ff803fbe21c in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) src/dom/events/EventListenerManager.cpp:1290:20
    #36 0x7ff803fa8687 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:527:16
    #37 0x7ff803fac423 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:933:9
    #38 0x7ff806270218 in nsDocumentViewer::LoadComplete(nsresult) src/layout/base/nsDocumentViewer.cpp:1066:7
    #39 0x7ff8093fe84b in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) src/docshell/base/nsDocShell.cpp:7217:21
    #40 0x7ff8093fac49 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp:7010:7
    #41 0x7ff80940254f in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp
    #42 0x7ff80008d0f7 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) src/uriloader/base/nsDocLoader.cpp:1315:3
    #43 0x7ff80008c17a in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:858:14
    #44 0x7ff800088d55 in nsDocLoader::DocLoaderIsEmpty(bool) src/uriloader/base/nsDocLoader.cpp:747:9
    #45 0x7ff80008ad1c in nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) src/uriloader/base/nsDocLoader.cpp:632:5
    #46 0x7ff80008bd3c in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) src/uriloader/base/nsDocLoader.cpp
    #47 0x7ff7fe4c1d2a in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) src/netwerk/base/nsLoadGroup.cpp:629:28
    #48 0x7ff8014279da in DoUnblockOnload src/dom/base/nsDocument.cpp:8409:18
    #49 0x7ff8014279da in nsDocument::UnblockOnload(bool) src/dom/base/nsDocument.cpp:8331
    #50 0x7ff80140833a in nsIDocument::DispatchContentLoadedEvents() src/dom/base/nsDocument.cpp:5314:3
    #51 0x7ff801523e74 in applyImpl<nsIDocument, void (nsIDocument::*)()> src/obj-firefox/dist/include/nsThreadUtils.h:1164:12
    #52 0x7ff801523e74 in apply<nsIDocument, void (nsIDocument::*)()> src/obj-firefox/dist/include/nsThreadUtils.h:1170
    #53 0x7ff801523e74 in mozilla::detail::RunnableMethodImpl<nsIDocument*, void (nsIDocument::*)(), true, (mozilla::RunnableKind)0>::Run() src/obj-firefox/dist/include/nsThreadUtils.h:1215
    #54 0x7ff7fe2e8c89 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1096:14
    #55 0x7ff7fe3046c0 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:519:10
    #56 0x7ff7ff1cd74a in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:97:21
    #57 0x7ff7ff122289 in RunInternal src/ipc/chromium/src/base/message_loop.cc:326:10
    #58 0x7ff7ff122289 in RunHandler src/ipc/chromium/src/base/message_loop.cc:319
    #59 0x7ff7ff122289 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:299
    #60 0x7ff805bd0d3a in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:157:27
    #61 0x7ff809c6006b in nsAppStartup::Run() src/toolkit/components/startup/nsAppStartup.cpp:290:30
    #62 0x7ff809e68c1c in XREMain::XRE_mainRun() src/toolkit/xre/nsAppRunner.cpp:4834:22
    #63 0x7ff809e6bd5c in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4979:8
    #64 0x7ff809e6d224 in XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:5071:21
    #65 0x4f168b in do_main src/browser/app/nsBrowserApp.cpp:231:22
    #66 0x4f168b in main src/browser/app/nsBrowserApp.cpp:304
    #67 0x7ff81da0582f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
    #68 0x420f48 in _start (firefox+0x420f48)

0x603000c19fd6 is located 0 bytes to the right of 22-byte region [0x603000c19fc0,0x603000c19fd6)
allocated by thread T0 here:
    #0 0x4c1c93 in malloc src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:88:3
    #1 0x7ff7fe1225a1 in nsStringBuffer::Alloc(unsigned long) src/xpcom/string/nsSubstring.cpp:256:22
    #2 0x7ff80159be4d in nsTextFragment::SetTo(char16_t const*, int, bool, bool) src/dom/base/nsTextFragment.cpp:302:11
    #3 0x7ff8011981cf in mozilla::dom::CharacterData::SetTextInternal(unsigned int, unsigned int, char16_t const*, unsigned int, bool, CharacterDataChangeInfo::Details*) src/dom/base/CharacterData.cpp:304:13
    #4 0x7ff80119b26e in mozilla::dom::CharacterData::SetText(char16_t const*, unsigned int, bool) src/dom/base/CharacterData.cpp:715:10
    #5 0x7ff8066f60f7 in SetText src/obj-firefox/dist/include/mozilla/dom/CharacterData.h:150:12
    #6 0x7ff8066f60f7 in nsTextControlFrame::UpdateValueDisplay(bool, bool, nsTSubstring<char16_t> const*) src/layout/forms/nsTextControlFrame.cpp:1326
    #7 0x7ff8043c2c4d in nsTextEditorState::SetValue(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const*, unsigned int) src/dom/html/nsTextEditorState.cpp:2509:22
    #8 0x7ff8042173f2 in mozilla::dom::HTMLInputElement::SetValueInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const*, unsigned int) src/dom/html/HTMLInputElement.cpp:2867:33
    #9 0x7ff8043c19b6 in nsTextEditorState::SetRangeText(nsTSubstring<char16_t> const&, unsigned int, unsigned int, mozilla::dom::SelectionMode, mozilla::ErrorResult&, mozilla::Maybe<unsigned int> const&, mozilla::Maybe<unsigned int> const&) src/dom/html/nsTextEditorState.cpp:1933:35
    #10 0x7ff80423b71f in mozilla::dom::HTMLInputElement::SetRangeText(nsTSubstring<char16_t> const&, unsigned int, unsigned int, mozilla::dom::SelectionMode, mozilla::ErrorResult&) src/dom/html/HTMLInputElement.cpp:5919:10
    #11 0x7ff803523123 in mozilla::dom::HTMLInputElementBinding::setRangeText(JSContext*, JS::Handle<JSObject*>, mozilla::dom::HTMLInputElement*, JSJitMethodCallArgs const&) src/obj-firefox/dom/bindings/HTMLInputElementBinding.cpp:3627:13
    #12 0x7ff80388d501 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3242:13
    #13 0x7ff80a13aad7 in CallJSNative src/js/src/vm/JSContext-inl.h:290:15
    #14 0x7ff80a13aad7 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:467
    #15 0x7ff80a1255cb in CallFromStack src/js/src/vm/Interpreter.cpp:522:12
    #16 0x7ff80a1255cb in Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3084
    #17 0x7ff80a10bcc7 in js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:417:12
    #18 0x7ff80a13a855 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:489:15
    #19 0x7ff80a13bad2 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) src/js/src/vm/Interpreter.cpp:535:10
    #20 0x7ff80ac2b5cd in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/jsapi.cpp:2977:12
    #21 0x7ff80301c93e in mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) src/obj-firefox/dom/bindings/EventHandlerBinding.cpp:264:37
    #22 0x7ff803ff6890 in Call<nsISupports *> src/obj-firefox/dist/include/mozilla/dom/EventHandlerBinding.h:363:12
    #23 0x7ff803ff6890 in mozilla::JSEventHandler::HandleEvent(nsIDOMEvent*) src/dom/events/JSEventHandler.cpp:215
    #24 0x7ff803fbca3c in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1121:51
    #25 0x7ff803fbe21c in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) src/dom/events/EventListenerManager.cpp:1290:20
    #26 0x7ff803fa8687 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:527:16
    #27 0x7ff803fac423 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:933:9
    #28 0x7ff806270218 in nsDocumentViewer::LoadComplete(nsresult) src/layout/base/nsDocumentViewer.cpp:1066:7
    #29 0x7ff8093fe84b in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) src/docshell/base/nsDocShell.cpp:7217:21
    #30 0x7ff8093fac49 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp:7010:7
    #31 0x7ff80940254f in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp
    #32 0x7ff80008d0f7 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) src/uriloader/base/nsDocLoader.cpp:1315:3
    #33 0x7ff80008c17a in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:858:14
Flags: in-testsuite?
Depends on: 1454126
No longer depends on: 1454126
See Also: → 1454126
Comment on attachment 8967919 [details]
testcase.html

Although, I don't create fuzzPriv extension environment, it seems that this might be fixed by bug 1454126 since this testcase tries to modify the DOM tree in <input> element.
Tyson, can you see if this still reproduces? If not, it sounds like we could dupe it. Thanks.
Flags: needinfo?(twsmith)
Keywords: sec-high
Status: NEW → RESOLVED
Closed: 3 years ago
Flags: needinfo?(twsmith)
Resolution: --- → DUPLICATE
Duplicate of bug: 1454126

Removing employee no longer with company from CC list of private bugs.

Group: dom-core-security
You need to log in before you can comment on or make changes to this bug.