1478585 - AddressSanitizer: heap-buffer-overflow [@ SkBlitLCD16OpaqueRow_SSE2] with READ of size 8

Status: RESOLVED INCOMPLETE

(Core :: Graphics, defect, P3)

Description

[Christian Holler (:decoder)]

The attached crash information was submitted via the ASan Nightly Reporter on mozilla-central-asan-nightly revision 63.0a1-20180724223402-https://hg.mozilla.org/mozilla-central/rev/dd386b5b9fa7f5cd6dc4bbbfa0503b3eb2969af5.

For detailed crash information, see attachment.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Daniel Veditz [:dveditz]]

Based on the stack it looks like this is doing math on values that will result in graphic output and not do pointer math or leak memory values into anything content-accessible.

Comment 3

[Lee Salzman [:lsalzman]]

I pored over this one, and based on the stack, all the code in the way looks valid and is not doing anything funny that I can overtly see causing this. Allocations look valid and the iteration that happens within the allocated memory looks valid.

It would really help if we had some way to reproduce this via a testcase, since I don't believe the cause is obvious just from the stacks and code inspection.

Comment 4

[David Bolter [:davidb] (NeedInfo me for attention)]

Marking P3 as it doesn't sound terrible, or actionable. Please raise if that changes. This might go away with a pending Skia update.

Comment 5

[Randell Jesup [:jesup] (needinfo me)]

(In reply to Daniel Veditz [:dveditz] from comment #2)
> Based on the stack it looks like this is doing math on values that will
> result in graphic output and not do pointer math or leak memory values into
> anything content-accessible.

Graphic output can be captured (often) or indirectly depended on, and if not melded into a lot of other gfx data extracted back to binary data (perhaps with some fuzz, but careful selection of the gfx data it's combined with can let value be extracted.  That said, I don't know this code, and I haven't pulled a crashdump from it and looked at the dump/disasm

Comment 6

[Andrew McCreight [:mccr8]]

Let's just close this. I don't think having an open bug with a one off ASan report from 5 years ago is useful. Somebody looked at it and couldn't figure anything out.