1562868 - Crash in [@ mozilla::ipc::ProcessLink::SendMessage | IPC_Message_Name=PCookieService::Msg_SetCookieString]

Status: RESOLVED FIXED

(Core :: Networking: Cookies, defect, P3)

Description

[Gabriele Svelto [:gsvelto]]

This bug is for crash report bp-aa6306f9-7763-473d-b254-b4ec90190630.

Top 10 frames of crashing thread:

0 xul.dll mozilla::ipc::ProcessLink::SendMessage ipc/glue/MessageLink.cpp:152
1 xul.dll mozilla::ipc::MessageChannel::Send ipc/glue/MessageChannel.cpp:995
2 xul.dll mozilla::net::PCookieServiceChild::SendSetCookieString ipc/ipdl/PCookieServiceChild.cpp:104
3 xul.dll nsresult mozilla::net::CookieServiceChild::SetCookieStringInternal netwerk/cookie/CookieServiceChild.cpp:553
4 xul.dll nsresult mozilla::net::CookieServiceChild::SetCookieString netwerk/cookie/CookieServiceChild.cpp:664
5 xul.dll mozilla::dom::Document::SetCookie dom/base/Document.cpp:5539
6 xul.dll static bool mozilla::dom::Document_Binding::set_cookie dom/bindings/DocumentBinding.cpp:2420
7 xul.dll mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::NormalThisPolicy> dom/bindings/BindingUtils.cpp:3124
8 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:540
9 xul.dll js::CallSetter js/src/vm/Interpreter.cpp:749

The raw crash reason is:

MOZ_CRASH(IPC message size is too large) - This is super sensitive data! Be careful how you use it!

This doesn't seem like a new bug, it just happens I spotted it while triaging nightly.

Comment 1

[Dragana Damjanovic [:dragana]]

Honza, can you take a look?

Comment 2

[Kershaw Chang [:kershaw]]

Not sure if we can send cookie string in chunks, like this.
Set it to P3 for now, since the crash rate is low.

Comment 3

[Andrea Marchesini [:baku]]

Attachment: Bug 1562868 - Limit the amount of data shared between processes when document.cookie is set - part 1 - separate cookie parser, r?ehsan

Comment 4

[Andrea Marchesini [:baku]]

Attachment: Bug 1562868 - Limit the amount of data shared between processes when document.cookie is set - part 2 - validate cookies in the content process, r?ehsan

Depends on D67355

Comment 6

[Andrea Marchesini [:baku]]

Attachment: Bug 1562868 - Limit the amount of data shared between processes when document.cookie is set, r?smaug

Depends on D67777

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c8bfef0a3dd3
Limit the amount of data shared between processes when document.cookie is set, r=smaug

Comment 8

[Andrei Ciure[:aciure]]

https://hg.mozilla.org/mozilla-central/rev/c8bfef0a3dd3