1490415 - null-ptr-deref in GPUVideoTextureHost::CreateRenderTexture

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect, P1)

Description

[Alex Gaynor [:Alex_Gaynor]]

This was found by the IPC fuzzer. It's not a security issue, but is preventing forward progress.

https://searchfox.org/mozilla-central/source/gfx/layers/composite/GPUVideoTextureHost.cpp#108 -- mWrappedTexture is null
https://searchfox.org/mozilla-central/source/gfx/layers/wr/WebRenderTextureHost.cpp#45 -- aTexture is the GPUVideoTextureHost instance
https://searchfox.org/mozilla-central/source/gfx/layers/wr/WebRenderTextureHost.cpp#16
https://searchfox.org/mozilla-central/source/gfx/layers/composite/TextureHost.cpp#258 -- result is the GPUVideoTextureHost

The GPUVideoTextureHost with mWrappedTexture=null came from: https://searchfox.org/mozilla-central/source/gfx/layers/composite/GPUVideoTextureHost.cpp#20

Comment 1

[Alex Gaynor [:Alex_Gaynor]]

Attachment: Bug 1490415 - prevent creating a GPUVideoTextureHost with a null wrapped texture; r?sotaro

Comment 2

[Sotaro Ikeda [:sotaro]]

Comment on attachment 9008132 [details]
Bug 1490415 - prevent creating a GPUVideoTextureHost with a null wrapped texture; r?sotaro

Sotaro Ikeda [:sotaro] has approved the revision.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1b27177d4eef
prevent creating a GPUVideoTextureHost with a null wrapped texture; r=sotaro

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a66a85285cb0
prevent creating a GPUVideoTextureHost with a null wrapped texture; r=sotaro

Comment 5

[Daniel Varga [:dvarga]]

https://hg.mozilla.org/mozilla-central/rev/1b27177d4eef

Comment 6

[Daniel Varga [:dvarga]]

https://hg.mozilla.org/mozilla-central/rev/a66a85285cb0