1490418 - [libFuzzer] Null-deref crash [@ mozilla::gfx::InlineTranslator::TranslateRecording]

Status: RESOLVED INCOMPLETE

(Core :: Graphics: WebRender, defect, P2)

Description

[Jesse Schwartzentruber (:truber)]

Attachment: testcase.cpp

The attached call to wr_moz2d_render_cb causes a null dereference in m-c rev 423bdf7a802b0d302244492b423609187de39f56.


==2448==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f0eba52a615 bp 0x7ffe0d60a0b0 sp 0x7ffe0d609f40 T0)
==2448==The signal is caused by a READ memory access.
==2448==Hint: address points to the zero page.
    #0 0x7f0eba52a614 in mozilla::gfx::DrawTargetSkia::Stroke(mozilla::gfx::Path const*, mozilla::gfx::Pattern const&, mozilla::gfx::StrokeOptions const&, mozilla::gfx::DrawOptions const&) /home/truber/src/m/u/gfx/2d/DrawTargetSkia.cpp:817:14
    #1 0x7f0eba58802c in mozilla::gfx::RecordedStroke::PlayEvent(mozilla::gfx::Translator*) const /home/truber/src/m/u/gfx/2d/RecordedEventImpl.h:2079:39
    #2 0x7f0eba57b5b9 in operator() /home/truber/src/m/u/gfx/2d/InlineTranslator.cpp:84:54
    #3 0x7f0eba57b5b9 in bool mozilla::gfx::RecordedEvent::DoWithEvent<mozilla::gfx::InlineTranslator::TranslateRecording(char*, unsigned long)::MemReader, mozilla::gfx::InlineTranslator::TranslateRecording(char*, unsigned long)::$_0>(mozilla::gfx::InlineTranslator::TranslateRecording(char*, unsigned long)::MemReader&, mozilla::gfx::RecordedEvent::EventType, mozilla::gfx::InlineTranslator::TranslateRecording(char*, unsigned long)::$_0) /home/truber/src/m/u/gfx/2d/RecordedEventImpl.h:3493
    #4 0x7f0eba56cbe8 in mozilla::gfx::InlineTranslator::TranslateRecording(char*, unsigned long) /home/truber/src/m/u/gfx/2d/InlineTranslator.cpp:77:20
    #5 0x7f0ebb42d22c in mozilla::wr::Moz2DRenderCallback(mozilla::Range<unsigned char const>, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits>, mozilla::gfx::SurfaceFormat, unsigned short const*, mozilla::wr::TypedPoint2D<unsigned short, mozilla::wr::Tiles> const*, mozilla::wr::TypedRect<unsigned int, mozilla::wr::DevicePixel> const*, mozilla::Range<unsigned char>) /home/truber/src/m/u/gfx/webrender_bindings/Moz2DImageRenderer.cpp:433:22
    #6 0x7f0ebb428cec in wr_moz2d_render_cb /home/truber/src/m/u/gfx/webrender_bindings/Moz2DImageRenderer.cpp:473:10
    #7 0x7f0ec799c62c in testMoz2DRenderCallback(unsigned char const*, unsigned long) /home/truber/src/m/u/gfx/tests/fuzzing/moz2d/TestMoz2D.cpp:91:3
    #8 0x55cdce792864 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /home/truber/src/m/u/tools/fuzzing/libfuzzer/FuzzerLoop.cpp:517:13
    #9 0x55cdce78f8f8 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) /home/truber/src/m/u/tools/fuzzing/libfuzzer/FuzzerLoop.cpp:442:3
    #10 0x55cdce794041 in fuzzer::Fuzzer::MutateAndTestOne() /home/truber/src/m/u/tools/fuzzing/libfuzzer/FuzzerLoop.cpp:650:19
    #11 0x55cdce796045 in fuzzer::Fuzzer::Loop(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, fuzzer::fuzzer_allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /home/truber/src/m/u/tools/fuzzing/libfuzzer/FuzzerLoop.cpp:773:5
    #12 0x55cdce776108 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /home/truber/src/m/u/tools/fuzzing/libfuzzer/FuzzerDriver.cpp:754:6
    #13 0x7f0ec64252c1 in mozilla::FuzzerRunner::Run(int*, char***) /home/truber/src/m/u/tools/fuzzing/interface/harness/FuzzerRunner.cpp:60:10
    #14 0x7f0ec6337275 in XREMain::XRE_mainStartup(bool*) /home/truber/src/m/u/toolkit/xre/nsAppRunner.cpp:3997:35
    #15 0x7f0ec634b4d3 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /home/truber/src/m/u/toolkit/xre/nsAppRunner.cpp:4956:12
    #16 0x7f0ec634d04e in XRE_main(int, char**, mozilla::BootstrapConfig const&) /home/truber/src/m/u/toolkit/xre/nsAppRunner.cpp:5063:21
    #17 0x55cdce6d66fc in do_main /home/truber/src/m/u/browser/app/nsBrowserApp.cpp:233:22
    #18 0x55cdce6d66fc in main /home/truber/src/m/u/browser/app/nsBrowserApp.cpp:315
    #19 0x7f0eddea982f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
    #20 0x55cdce5d6038 in _start (/home/truber/src/m/u/obj/ff-asan-release/dist/bin/firefox+0x37038)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/truber/src/m/u/gfx/2d/DrawTargetSkia.cpp:817:14 in mozilla::gfx::DrawTargetSkia::Stroke(mozilla::gfx::Path const*, mozilla::gfx::Pattern const&, mozilla::gfx::StrokeOptions const&, mozilla::gfx::DrawOptions const&)
==2448==ABORTING

Comment 1

[Jeff Muizelaar [:jrmuizel]]

This is not exploitable. I don't think we should block on it.

Comment 2

[Andrei Purice]

Hey Jesse,
Can you still reproduce this issue or can it be closed?

Comment 3

[Andrei Purice]

Marking this as Resolved > Incomplete due to the lack of info.
If anyone is able to reproduce this issue re-open it or file a new bug.