1521474 - Crash in nsHostResolver::ResolveHost

Status: RESOLVED DUPLICATE of bug 1513519

(Core :: Networking: DNS, defect)

Description

[Gabriele Svelto [:gsvelto]]

This bug is for crash report bp-d702cb1b-4521-4b0f-8e31-6c6b30190121.

Top 10 frames of crashing thread:

0 libxul.so nsHostResolver::ResolveHost mfbt/RefPtr.h:44
1 libxul.so nsDNSService::AsyncResolveInternal netwerk/dns/nsDNSService2.cpp:849
2 libxul.so nsHTMLDNSPrefetch::nsDeferrals::SubmitQueue dom/html/nsHTMLDNSPrefetch.cpp:376
3 libxul.so nsHTMLDNSPrefetch::nsDeferrals::OnStateChange dom/html/nsHTMLDNSPrefetch.cpp:472
4 libxul.so nsDocLoader::DoFireOnStateChange uriloader/base/nsDocLoader.cpp:1235
5 libxul.so nsDocLoader::doStopDocumentLoad uriloader/base/nsDocLoader.cpp:794
6 libxul.so nsDocLoader::DocLoaderIsEmpty uriloader/base/nsDocLoader.cpp:693
7 libxul.so nsDocLoader::OnStopRequest uriloader/base/nsDocLoader.cpp:588
8 libxul.so non-virtual thunk to nsDocLoader::OnStopRequest uriloader/base/nsDocLoader.cpp
9 libxul.so mozilla::net::nsLoadGroup::RemoveRequest netwerk/base/nsLoadGroup.cpp:575

A lot of crash addresses start with the e5e5e5 pattern so this is most likely an UAF. Curiously it seems to be Android-only.

Comment 1

[Dragana Damjanovic [:dragana]]

This is dup of 1513519.

Comment 2

[Dragana Damjanovic [:dragana]]

Can you reproduce it?

Comment 3

[Gabriele Svelto [:gsvelto]]

Unfortunately not, I found this during triage. Looking at the reports' URLs the one that comes up most often is http://m.spiegel.de/. There's no useful comments though.