1486030 - VideoBridgeParent::AllocPTextureParent doesn't handle failures in TextureHost::CreateIPDLActor

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect, P3)

Description

[Alex Gaynor [:Alex_Gaynor]]

This was found with IPC fuzzer:

https://searchfox.org/mozilla-central/source/gfx/layers/ipc/VideoBridgeParent.cpp#65-67

There are various ways that TextureHost::CreateIPDLActor can fail based on data provided. When a nullptr is inserted into mTextureMap, things will later try to dereference it.

This isn't a security issue, but rather a fuzzing efficiency issue.

I believe what needs to be done is to add an |if (!parent) { return nullptr; }| to 
VideoBridgeParent::AllocPTextureParent.

Comment 1

[Nicolas Silva [:nical]]

Makes sense. If we return a null actor in an AllocPFoo function it'll generate an error and kill the child process which is probably the best outcome if the parent is unable keep up with the child.

Comment 2

[Nicolas Silva [:nical]]

Attachment: Bug 1486030 - Don't keep a null texture in the video bridge texture map. r=sotaro

Comment 3

[Sotaro Ikeda [:sotaro]]

Comment on attachment 9004170 [details]
Bug 1486030 - Don't keep a null texture in the video bridge texture map. r=sotaro

Sotaro Ikeda [:sotaro PTO 31/Aug-7/Sep] has approved the revision.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a22894e14cc6
Don't keep a null texture in the video bridge texture map. r=sotaro

Comment 5

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/a22894e14cc6