1577572 - IPC: crash [@mozilla::dom::ipc::SharedStringMap::SharedStringMap]

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P2)

Description

[Christoph Diehl [:posidron]]

Attachment: clusterfuzz-testcase-minimized-ContentSecurityPolicyParser-5652140273434624

Task

Item	Description
Crash Type	Null-dereference WRITE
Sanitizer	address (ASAN)
Platform	linux
Job Type	libfuzzer_asan_firefox
Fuzz Target	ContentSecurityPolicyParser
Reliably Reproduces	YES

Callstack

==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fdcdf5a0f7e bp 0x7ffd4bb7fb50 sp 0x7ffd4bb7faa0 T0)
==1==The signal is caused by a WRITE memory access.
==1==Hint: address points to the zero page.
SCARINESS: 10 (null-deref)
    #0 0x7fdcdf5a0f7d in mozilla::dom::ipc::SharedStringMap::SharedStringMap(mozilla::dom::ipc::SharedStringMapBuilder&&) mozilla-central/dom/ipc/SharedStringMap.cpp:46:3
    #1 0x7fdcd97490a0 in (anonymous namespace)::SharedStringBundle::LoadProperties() mozilla-central/intl/strres/nsStringBundle.cpp:521:20
    #2 0x7fdcd9749454 in (anonymous namespace)::SharedStringBundle::GetStringImpl(nsTSubstring<char> const&, nsTSubstring<char16_t>&) mozilla-central/intl/strres/nsStringBundle.cpp:566:3
    #3 0x7fdcd9742fc2 in nsStringBundleBase::GetStringFromName(char const*, nsTSubstring<char16_t>&) mozilla-central/intl/strres/nsStringBundle.cpp:554:10
    #4 0x7fdcd974377d in nsStringBundleBase::FormatStringFromName(char const*, nsTArray<nsTString<char16_t> > const&, nsTSubstring<char16_t>&) mozilla-central/intl/strres/nsStringBundle.cpp:602:17
    #5 0x7fdcdf0f9178 in CSP_GetLocalizedStr(char const*, nsTArray<nsTString<char16_t> > const&, nsTSubstring<char16_t>&) mozilla-central/dom/security/nsCSPUtils.cpp:169:20
    #6 0x7fdcdf0f938e in CSP_LogLocalizedStr(char const*, nsTArray<nsTString<char16_t> > const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, unsigned int, unsigned int, unsigned int, nsTSubstring<char> const&, unsigned long, bool) mozilla-central/dom/security/nsCSPUtils.cpp:247:3
    #7 0x7fdcdf0f8e3d in nsCSPContext::logToConsole(char const*, nsTArray<nsTString<char16_t> > const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, unsigned int, unsigned int, unsigned int) mozilla-central/dom/security/nsCSPContext.cpp:867:3
    #8 0x7fdcdf101513 in nsCSPParser::logWarningErrorToConsole(unsigned int, char const*, nsTArray<nsTString<char16_t> > const&) mozilla-central/dom/security/nsCSPParser.cpp:187:16
    #9 0x7fdcdf107a3c in nsCSPParser::directiveName() mozilla-central/dom/security/nsCSPParser.cpp:844:5
    #10 0x7fdcdf10859e in nsCSPParser::directive() mozilla-central/dom/security/nsCSPParser.cpp:962:28
    #11 0x7fdcdf10963f in nsCSPParser::policy() mozilla-central/dom/security/nsCSPParser.cpp:1094:5
    #12 0x7fdcdf0f4624 in nsCSPParser::parseContentSecurityPolicy(nsTSubstring<char16_t> const&, nsIURI*, bool, nsCSPContext*, bool) mozilla-central/dom/security/nsCSPParser.cpp:1148:32
    #13 0x7fdcdf0f4050 in nsCSPContext::AppendPolicy(nsTSubstring<char16_t> const&, bool, bool) mozilla-central/dom/security/nsCSPContext.cpp:422:25
    #14 0x7fdcd8fdb4fe in LLVMFuzzerTestOneInput(unsigned char const*, unsigned long) mozilla-central/dom/security/fuzztest/csp_fuzzer.cpp:33:8
    #15 0x55ac36a5729f in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long)
    #16 0x55ac36a439de in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long)
    #17 0x55ac36a45c99 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long))
    #18 0x7fdce27cb251 in mozilla::FuzzerRunner::Run(int*, char***) mozilla-central/tools/fuzzing/interface/harness/FuzzerRunner.cpp:61:10
    #19 0x7fdce271c40e in XREMain::XRE_mainStartup(bool*) mozilla-central/toolkit/xre/nsAppRunner.cpp:3793:35
    #20 0x7fdce2724c52 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) mozilla-central/toolkit/xre/nsAppRunner.cpp:4728:12
    #21 0x7fdce2725601 in XRE_main(int, char**, mozilla::BootstrapConfig const&) mozilla-central/toolkit/xre/nsAppRunner.cpp:4822:21
    #22 0x55ac3695bb4a in do_main(int, char**, char**)
    #23 0x55ac3695b332 in main
    #24 0x7fdcf43d882f in __libc_start_main
    #25 0x55ac3687d028 in _start
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_firefox_6180546f5e5f1d75138bf6cea3784693af7a2aa9/revisions/firefox/libxul.so+0x114e9f7d)
==1==ABORTING

Comment 1

[BugBot [:suhaib / :marco]]

The priority flag is not set for this bug.
:wleung, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 2

[Christoph Kerschbaumer [:ckerschb]]

Looks, like a CSP issue, will evaluate in the triage meeting tomorrow - moving over to dom:security.

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

I guess we'll fix that by adding a null check :-)

Comment 4

[Christoph Kerschbaumer [:ckerschb]]

Attachment: Bug 1577572: Make sure a CSP of '\FF' does not crash

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e15b3e01fff2
Make sure a CSP of '\FF' does not crash r=freddyb

Comment 6

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/e15b3e01fff2