Closed Bug 1473943 Opened 4 years ago Closed 4 years ago
Robustify blob replay against bad data
46 bytes, text/x-phabricator-request
|Details | Review|
When I was working on bug 1469528 I noticed that there is little sanity-checking of the blob images in the compositor. We just take the blob and run it through the replay mechanism, and that provides a lot of opportunities for a malicious content process to corrupt rendering, crash the compositor, or even potentially write to arbitrary memory , which would be Really Bad. This needs to be fixed before we ship.  https://searchfox.org/mozilla-central/rev/1193ef6a61cb6e350460eb2e8468184d3cb0321d/gfx/webrender_bindings/Moz2DImageRenderer.cpp#303
Comment on attachment 9003344 [details] Bug 1473943. Make blob bounds checks safe. r=mstange Markus Stange [:mstange] has approved the revision.
Attachment #9003344 - Flags: review+
Pushed by email@example.com: https://hg.mozilla.org/integration/autoland/rev/73ffc23ea21b Make blob bounds checks safe. r=mstange
You need to log in before you can comment on or make changes to this bug.