1509200 - Firefox passes uninitialized memory to Windows authentication API (maybe?)

Status: RESOLVED DUPLICATE of bug 1508936

(Firefox :: WebPayments UI, defect)

Description

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Attachment: Capture.PNG

I have a test case which reliably seems to pass memory to the Windows API responsible for showing OS authentication prompts. I doubt its an exploitable security issue, but its a concerning state. 

I'm leaving this public, as we are not shipping this API yet, so currently it poses no risk (but it might once its shipped, depending on what is actually going on here). 


STR:

1. Load https://misuse.co/t/pay/testcase.html
2. click the button, and enter details and hit pay
3. you will see an auth prompt with garbled text

Expected:
Not garbled text. 

Actual:
See attachment

Comment 2

[Matthew N. [:MattN]]

Could we dupe to the public bug 1508936?

Comment 3

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Yeh its probably fine, was just being overly cautious.