1513201 - AddressSanitizer: heap-buffer-overflow [@ NS_strlen] with READ of size 2

Status: RESOLVED FIXED

(Core :: Widget: Win32, defect)

Description

[Christian Holler (:decoder)]

The attached crash information was submitted via the ASan Nightly Reporter on mozilla-central-asan-nightly revision 65.0a1-20181210095504-https://hg.mozilla.org/mozilla-central/rev/3386ff76878d83496bb822d09115c77472808b53.

For detailed crash information, see attachment.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 3

[Christian Holler (:decoder)]

From the stack it looks like this is reachable via IPC and might be s-s in a sandboxing context.

Comment 4

[Alex Gaynor [:Alex_Gaynor]]

This looks similar to bug 1451308. :mats, it looks like you were the last person to look at that one, do you agree?

Comment 5

[Mats Palmgren (inactive)]

Yeah, this looks like it's the same issue.

Comment 6

[Christian Holler (:decoder)]

Reopening, see comment in other bug.

Comment 8

[Alex Gaynor [:Alex_Gaynor]]

Attachment: Bug 1451308 - handle pasted data of certain types with an odd length; r?mats

Comment 9

[Alex Gaynor [:Alex_Gaynor]]

Carrying over the security triage from the original bug.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/autoland/rev/47aeeaf1c35b

Comment 11

[Ryan VanderMeulen [:RyanVM]]

This was backed out for Windows MinGW build bustage.
https://hg.mozilla.org/integration/autoland/rev/63525718264d

https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=216459339&repo=autoland

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/autoland/rev/540d3ce3b9e4c307dd85d46b0130a0ee6ea83cc3

Comment 13

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/540d3ce3b9e4

Comment 14

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for Beta/ESR60 approval when you get a chance.

Comment 15

[Alex Gaynor [:Alex_Gaynor]]

Comment on attachment 9030519 [details]
Bug 1451308 - handle pasted data of certain types with an odd length; r?mats

[Beta/Release Uplift Approval Request]

Feature/Bug causing the regression: None

User impact if declined: Potential IPC security issue and/or full browser crash when you're pasting certain types of content (it seems particularly Chinese content).

Is this code covered by automated tests?: Unknown

Has the fix been verified in Nightly?: Yes

Needs manual test from QE?: No

If yes, steps to reproduce: 

List of other uplifts needed: None

Risk to taking this patch: Low

Why is the change risky/not risky? (and alternatives if risky): Code change is exceptionally straight forward.

String changes made/needed: 

[ESR Uplift Approval Request]

If this is not a sec:{high,crit} bug, please state case for ESR consideration: sec-moderate, full browser crash

User impact if declined: Same as beta

Fix Landed on Version: 

Risk to taking this patch: Low

Why is the change risky/not risky? (and alternatives if risky): Code change is exceptionally straight forward.

String or UUID changes made by this patch:

Comment 16

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9030519 [details]
Bug 1451308 - handle pasted data of certain types with an odd length; r?mats

[Triage Comment]
Fixes a security-sensitive crash, approved for 65.0b5. We'll revisit the ESR request later in the cycle.

Comment 17

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/3ebfb70bbd0b

Comment 18

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9030519 [details]
Bug 1451308 - handle pasted data of certain types with an odd length; r?mats

Approved for 60.5.0esr also.

Comment 19

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr60/rev/755a27adc485