1555051 - Crash in [@ java.lang.SecurityException: at org.apache.harmony.security.utils.JarUtils.verifySignature(JarUtils.java)]

Status: VERIFIED FIXED

(Firefox for Android :: General, defect, P1, critical)

Description

[Marcia Knous [:marcia - needinfo? me/PTO 12/6-12/12)]]]

This bug is for crash report bp-66a59d08-6914-4e72-aa90-124a30190528.

Seen while looking at 68 beta crash stats. Crashes started during 68 nightly cycle. APIs from 16-18 appear to be affected: https://bit.ly/2HGzybE.

Some correlations for beta:

(87.50% in signature vs 08.95% overall) minidump_sha256_hash = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
(87.50% in signature vs 09.34% overall) address = null
(87.50% in signature vs 09.34% overall) platform = Unknown
(87.50% in signature vs 09.34% overall) reason = null
(12.50% in signature vs 90.66% overall) platform = Android
(85.00% in signature vs 07.41% overall) startup_crash = null
(15.00% in signature vs 86.43% overall) startup_crash = 0
(15.00% in signature vs 79.98% overall) Addon "[e-mail]" = true
(15.00% in signature vs 79.69% overall) Addon "[e-mail]" = true
(12.50% in signature vs 68.72% overall) reason = SIGSEGV /SEGV_MAPERR
(12.50% in signature vs 51.68% overall) address = 0x0
(45.00% in signature vs 03.75% overall) android_hardware = smdk4x12
(45.00% in signature vs 03.75% overall) android_board = smdk4x12
(45.00% in signature vs 04.23% overall) android_version = 16 (REL)
(42.50% in signature vs 07.80% overall) android_version = 17 (REL)
(32.50% in signature vs 01.25% overall) android_model = GT-N8010
(32.50% in signature vs 01.25% overall) android_device = p4notewifiww
(25.00% in signature vs 01.15% overall) android_board = SBM303SH
(25.00% in signature vs 01.15% overall) android_device = SBM303SH
(25.00% in signature vs 01.15% overall) android_model = SBM303SH
(25.00% in signature vs 01.15% overall) android_brand = SBM

Java stack trace:

java.lang.SecurityException
	at org.apache.harmony.security.utils.JarUtils.verifySignature(JarUtils.java:180)
	at java.util.jar.JarVerifier.verifyCertificate(JarVerifier.java:302)
	at java.util.jar.JarVerifier.readCertificates(JarVerifier.java:271)
	at java.util.jar.JarFile.getInputStream(JarFile.java:398)
	at libcore.net.url.JarURLConnectionImpl.getInputStream(JarURLConnectionImpl.java:226)
	at java.net.URL.openStream(URL.java:462)
	at org.mozilla.gecko.util.BitmapUtils.decodeUrl(BitmapUtils.java:105)
	at org.mozilla.gecko.util.BitmapUtils.decodeUrl(BitmapUtils.java:98)
	at org.mozilla.gecko.lwt.LightweightTheme$LightweightThemeRunnable.run(LightweightTheme.java:133)
	at android.os.Handler.handleCallback(Handler.java:725)
	at android.os.Handler.dispatchMessage(Handler.java:92)
	at android.os.Looper.loop(Looper.java:176)
	at org.mozilla.gecko.util.GeckoBackgroundThread.run(GeckoBackgroundThread.java:41)

Comment 1

[Marcia Knous [:marcia - needinfo? me/PTO 12/6-12/12)]]]

Fairly low volume. Triaging as a P3 based on this fact.

Comment 2

[Marcia Knous [:marcia - needinfo? me/PTO 12/6-12/12)]]]

28 crashes/14 installs so far in b7. No useful comments. High % of crashes are startup crashes:

(82.61% in signature vs 07.24% overall) startup_crash = null

Comment 3

[Ryan VanderMeulen [:RyanVM]]

This is the #1 top crash on Fennec Nightly 68.0a1 at the moment. Devin, are you the right person to get this on the radar for investigation?

Comment 4

[Devin Reams (dreams)]

I'm not well versed enough to translate the stack but I think this may be related to certificates?

Petru and team, this seems Android (not Gecko) specific. Can you help take a look and see what you think?

Comment 5

[Petru-Mugurel Lingurar[:petru]]

I'm seeing this error when trying to install/set a theme
as we would try to get it's icon from an URL like

jar:file:///data/data/org.mozilla.fennec_petru.lingurar/files/mozilla/r4t57k5x.default/extensions/%7B250e3114-c154-48dd-8d71-56e794641495%7D.xpi!/5.jpg

This seems especially bad because in my tests I see that it would always crash the app afterwards immediately after being started.

Comment 6

[Petru-Mugurel Lingurar[:petru]]

This change seem to stem from how we now persist themes (as xpis).
Previously all theme files would be easily accessible and the image would have an url like

file:///data/data/org.mozilla.fennec_petrulingurar/files/mozilla/njcj6pk3.default/lightweighttheme-header

I don't think we need to invest time to track the regression though as we have an easy solution to read from the xpi: GeckoJarReader

Comment 7

[Petru-Mugurel Lingurar[:petru]]

Attachment: Bug 1555051 - Use GeckoJarReader to read the theme image; r?VladBaicu

If the theme is persisted as an xpi we'll use GeckoJarReader to read get the
image from inside the archive otherwise read it directly.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/53b89d516cbc
Use GeckoJarReader to read the theme image; r=VladBaicu

Comment 9

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/mozilla-central/rev/53b89d516cbc

Comment 10

[Chris Peterson [:cpeterson]]

[Tracking Requested - why for this release]:

We will want to uplift this Fennec crash fix to the ESR 68 branch for the Fennec 68.1 release.

Comment 11

[Petru-Mugurel Lingurar[:petru]]

Bug was 100% reproducible on Android API level 16, 17, 18
by just installing a theme from https://addons.mozilla.org/en-US/android/themes/
Upon installation the app would crash and subsequent app starts would crash as well.
Please check if the issue is fixed on those API levels and that themes work as intended on higher versions of Android.

Comment 12

[Chris Peterson [:cpeterson]]

(In reply to Petru-Mugurel Lingurar[:petru] from comment #11)

Bug was 100% reproducible on Android API level 16, 17, 18
by just installing a theme from https://addons.mozilla.org/en-US/android/themes/

That sounds like a bad regression. Should we uplift this fix to Fennec 68 release or a 68.0.1 dot release?

Comment 13

[Julien Cristau [:jcristau]]

Please request beta uplift so we don't ship this.

Comment 14

[Petru-Mugurel Lingurar[:petru]]

Comment on attachment 9073838 [details]
Bug 1555051 - Use GeckoJarReader to read the theme image; r?VladBaicu

Beta/Release Uplift Approval Request

• User impact if declined: Constant crashes after installing a theme on Android 4.1 / 4.2 / 4.3
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: Install a theme
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Small targetted change.
• String changes made/needed:

Comment 15

[Julien Cristau [:jcristau]]

Comment on attachment 9073838 [details]
Bug 1555051 - Use GeckoJarReader to read the theme image; r?VladBaicu

thanks, approved for beta68

Comment 16

[Julien Cristau [:jcristau]]

https://hg.mozilla.org/releases/mozilla-beta/rev/2638b73811db

Comment 17

[Andrei Bodea[:andrei]]

I can confirm that this issue cannot be reproduced anymore using the latest build from treeherder(69.0a1) that included the patch with the fix.
I tried to reproduce this issue using Alcatel One Touch(Android 4.1.2) and everything worked as expected.

Comment 18

[Andrei Bodea[:andrei]]

Verified as fixed on the latest Beta build v68.0b14 using Alcatel One Touch(Android 4.1.2).