VideoBridgeParent::AllocPTextureParent doesn't handle failures in TextureHost::CreateIPDLActor

RESOLVED FIXED in Firefox 63

Status

()

defect
P3
normal
RESOLVED FIXED
10 months ago
10 months ago

People

(Reporter: Alex_Gaynor, Assigned: nical)

Tracking

(Blocks 1 bug)

Trunk
mozilla63
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox63 fixed)

Details

(Whiteboard: gfx-noted)

Attachments

(1 attachment)

Reporter

Description

10 months ago
This was found with IPC fuzzer:

https://searchfox.org/mozilla-central/source/gfx/layers/ipc/VideoBridgeParent.cpp#65-67

There are various ways that TextureHost::CreateIPDLActor can fail based on data provided. When a nullptr is inserted into mTextureMap, things will later try to dereference it.

This isn't a security issue, but rather a fuzzing efficiency issue.

I believe what needs to be done is to add an |if (!parent) { return nullptr; }| to 
VideoBridgeParent::AllocPTextureParent.
Assignee

Comment 1

10 months ago
Makes sense. If we return a null actor in an AllocPFoo function it'll generate an error and kill the child process which is probably the best outcome if the parent is unable keep up with the child.
Priority: -- → P3
Whiteboard: gfx-noted
Comment on attachment 9004170 [details]
Bug 1486030 - Don't keep a null texture in the video bridge texture map. r=sotaro

Sotaro Ikeda [:sotaro PTO 31/Aug-7/Sep] has approved the revision.
Attachment #9004170 - Flags: review+

Comment 4

10 months ago
Pushed by nsilva@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/a22894e14cc6
Don't keep a null texture in the video bridge texture map. r=sotaro

Comment 5

10 months ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/a22894e14cc6
Status: NEW → RESOLVED
Closed: 10 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla63
Assignee: nobody → nical.bugzilla
You need to log in before you can comment on or make changes to this bug.