Closed Bug 1605777 Opened 6 years ago Closed 6 years ago

heap-use-after-free z:\build\build\src\gfx\layers\basic\BasicCompositor.cpp:129 in mozilla::layers::WrappingTextureSourceYCbCrBasic::GetSurface(class mozilla::gfx::DrawTarget *)

Categories

(Core :: Graphics: Layers, defect)

Product:
Core
Component:
Graphics: Layers
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla74
Tracking Flags:
Tracking Status
firefox-esr68 73+ fixed
firefox72 --- wontfix
firefox73 + fixed
firefox74 + fixed

People

(Reporter: RaulG, Assigned: sotaro)

Details

(Keywords: csectype-uaf, sec-high, Whiteboard: [adv-main73+r][adv-esr68.5+r])

Attachments

(1 file)

Bug 1605777 - Clear WrappingTextureSourceYCbCrBasic::mTexture correctly
47 bytes, text/x-phabricator-request
RyanVM
: approval-mozilla-release+
RyanVM
: approval-mozilla-esr68+
tjr
: sec-approval+
Details | Review

TH link: https://treeherder.mozilla.org/#/jobs?repo=autoland&selectedJob=282418857&resultStatus=testfailed%2Cbusted%2Cexception&revision=6493da33ecacf937e915726cb71f9f1ec3f68da1

Log link: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=282418857&repo=autoland&lineNumber=5504

Log snippet:
[task 2019-12-23T18:52:43.411Z] 18:52:43 INFO - TEST-START | toolkit/components/pictureinpicture/tests/browser_disabledForMediaStreamVideos.js
[task 2019-12-23T18:52:44.830Z] 18:52:44 INFO - GECKO(10312) | =================================================================
[task 2019-12-23T18:52:44.830Z] 18:52:44 ERROR - GECKO(10312) | ==5364==ERROR: AddressSanitizer: heap-use-after-free on address 0x122c9b8bdcc0 at pc 0x7ff9695723ff bp 0x00c8ddbfa5c0 sp 0x00c8ddbfa608
[task 2019-12-23T18:52:44.830Z] 18:52:44 INFO - GECKO(10312) | READ of size 4 at 0x122c9b8bdcc0 thread T2
[task 2019-12-23T18:52:45.193Z] 18:52:45 INFO - GECKO(10312) | #0 0x7ff9695723fe in mozilla::layers::WrappingTextureSourceYCbCrBasic::GetSurface(class mozilla::gfx::DrawTarget *) z:\build\build\src\gfx\layers\basic\BasicCompositor.cpp:129
[task 2019-12-23T18:52:45.194Z] 18:52:45 INFO - GECKO(10312) | #1 0x7ff96955b618 in mozilla::layers::BasicCompositor::DrawGeometry<struct mozilla::gfx::RectTyped<struct mozilla::gfx::UnknownUnits,float> >(struct mozilla::gfx::RectTyped<struct mozilla::gfx::UnknownUnits,float> const &,struct mozilla::gfx::RectTyped<struct mozilla::gfx::UnknownUnits,float> const &,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &,struct mozilla::layers::EffectChain const &,float,class mozilla::gfx::Matrix4x4Typed<struct mozilla::gfx::UnknownUnits,struct mozilla::gfx::UnknownUnits,float> const &,struct mozilla::gfx::RectTyped<struct mozilla::gfx::UnknownUnits,float> const &,bool) z:\build\build\src\gfx\layers\basic\BasicCompositor.cpp:722
[task 2019-12-23T18:52:45.194Z] 18:52:45 INFO - GECKO(10312) | #2 0x7ff969559dc1 in mozilla::layers::BasicCompositor::DrawQuad(struct mozilla::gfx::RectTyped<struct mozilla::gfx::UnknownUnits,float> const &,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &,struct mozilla::layers::EffectChain const &,float,class mozilla::gfx::Matrix4x4Typed<struct mozilla::gfx::UnknownUnits,struct mozilla::gfx::UnknownUnits,float> const &,struct mozilla::gfx::RectTyped<struct mozilla::gfx::UnknownUnits,float> const &) z:\build\build\src\gfx\layers\basic\BasicCompositor.cpp:597
[task 2019-12-23T18:52:45.195Z] 18:52:45 INFO - GECKO(10312) | #3 0x7ff96963d7aa in mozilla::layers::Compositor::DrawGeometry(struct mozilla::gfx::RectTyped<struct mozilla::gfx::UnknownUnits,float> const &,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &,struct mozilla::layers::EffectChain const &,float,class mozilla::gfx::Matrix4x4Typed<struct mozilla::gfx::UnknownUnits,struct mozilla::gfx::UnknownUnits,float> const &,struct mozilla::gfx::RectTyped<struct mozilla::gfx::UnknownUnits,float> const &,class mozilla::Maybe<class mozilla::gfx::PolygonTyped<struct mozilla::gfx::UnknownUnits> > const &) z:\build\build\src\gfx\layers\Compositor.cpp:240
[task 2019-12-23T18:52:45.195Z] 18:52:45 INFO - GECKO(10312) | #4 0x7ff969b3b91b in mozilla::layers::ImageHost::Composite(class mozilla::layers::Compositor *,class mozilla::layers::LayerComposite *,struct mozilla::layers::EffectChain &,float,class mozilla::gfx::Matrix4x4Typed<struct mozilla::gfx::UnknownUnits,struct mozilla::gfx::UnknownUnits,float> const &,enum mozilla::gfx::SamplingFilter,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &,class mozilla::gfx::IntRegionTyped<struct mozilla::gfx::UnknownUnits> const *,class mozilla::Maybe<class mozilla::gfx::PolygonTyped<struct mozilla::gfx::UnknownUnits> > const &) z:\build\build\src\gfx\layers\composite\ImageHost.cpp:277
[task 2019-12-23T18:52:45.196Z] 18:52:45 INFO - GECKO(10312) | #5 0x7ff969bb03f1 in mozilla::layers::ImageLayerComposite::RenderLayer(const mozilla::gfx::IntRect &, const Maybe<gfx::Polygon> &)::(anonymous class)::operator() z:\build\build\src\gfx\layers\composite\ImageLayerComposite.cpp:95
[task 2019-12-23T18:52:45.196Z] 18:52:45 INFO - GECKO(10312) | #6 0x7ff969b400c5 in mozilla::layers::ImageLayerComposite::RenderLayer(struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &,class mozilla::Maybe<class mozilla::gfx::PolygonTyped<struct mozilla::gfx::UnknownUnits> > const &) z:\build\build\src\gfx\layers\composite\ImageLayerComposite.cpp:92
[task 2019-12-23T18:52:45.196Z] 18:52:45 INFO - GECKO(10312) | #7 0x7ff969b9c650 in mozilla::layers::RenderLayers<class mozilla::layers::ContainerLayerComposite>(class mozilla::layers::ContainerLayerComposite *,class mozilla::layers::LayerManagerComposite *,struct mozilla::gfx::IntRectTyped<struct mozilla::RenderTargetPixel> const &,class mozilla::Maybe<class mozilla::gfx::PolygonTyped<struct mozilla::gfx::UnknownUnits> > const &) z:\build\build\src\gfx\layers\composite\ContainerLayerComposite.cpp:474
[task 2019-12-23T18:52:45.196Z] 18:52:45 INFO - GECKO(10312) | #8 0x7ff969b15c37 in mozilla::layers::ContainerRender<class mozilla::layers::ContainerLayerComposite>(class mozilla::layers::ContainerLayerComposite *,class mozilla::layers::LayerManagerComposite *,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &,class mozilla::Maybe<class mozilla::gfx::PolygonTyped<struct mozilla::gfx::UnknownUnits> > const &) z:\build\build\src\gfx\layers\composite\ContainerLayerComposite.cpp:646
[task 2019-12-23T18:52:45.197Z] 18:52:45 INFO - GECKO(10312) | #9 0x7ff969ba8190 in mozilla::layers::RenderLayers<class mozilla::layers::RefLayerComposite>(class mozilla::layers::RefLayerComposite *,class mozilla::layers::LayerManagerComposite *,struct mozilla::gfx::IntRectTyped<struct mozilla::RenderTargetPixel> const &,class mozilla::Maybe<class mozilla::gfx::PolygonTyped<struct mozilla::gfx::UnknownUnits> > const &) z:\build\build\src\gfx\layers\composite\ContainerLayerComposite.cpp:474
[task 2019-12-23T18:52:45.197Z] 18:52:45 INFO - GECKO(10312) | #10 0x7ff969b19867 in mozilla::layers::ContainerRender<class mozilla::layers::RefLayerComposite>(class mozilla::layers::RefLayerComposite *,class mozilla::layers::LayerManagerComposite *,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &,class mozilla::Maybe<class mozilla::gfx::PolygonTyped<struct mozilla::gfx::UnknownUnits> > const &) z:\build\build\src\gfx\layers\composite\ContainerLayerComposite.cpp:646
[task 2019-12-23T18:52:45.197Z] 18:52:45 INFO - GECKO(10312) | #11 0x7ff969b9c650 in mozilla::layers::RenderLayers<class mozilla::layers::ContainerLayerComposite>(class mozilla::layers::ContainerLayerComposite *,class mozilla::layers::LayerManagerComposite *,struct mozilla::gfx::IntRectTyped<struct mozilla::RenderTargetPixel> const &,class mozilla::Maybe<class mozilla::gfx::PolygonTyped<struct mozilla::gfx::UnknownUnits> > const &) z:\build\build\src\gfx\layers\composite\ContainerLayerComposite.cpp:474
[task 2019-12-23T18:52:45.197Z] 18:52:45 INFO - GECKO(10312) | #12 0x7ff969b15c37 in mozilla::layers::ContainerRender<class mozilla::layers::ContainerLayerComposite>(class mozilla::layers::ContainerLayerComposite *,class mozilla::layers::LayerManagerComposite *,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &,class mozilla::Maybe<class mozilla::gfx::PolygonTyped<struct mozilla::gfx::UnknownUnits> > const &) z:\build\build\src\gfx\layers\composite\ContainerLayerComposite.cpp:646
[task 2019-12-23T18:52:45.197Z] 18:52:45 INFO - GECKO(10312) | #13 0x7ff969b6bf7c in mozilla::layers::LayerManagerComposite::Render(const nsIntRegion &, const nsIntRegion &)::(anonymous class)::operator() z:\build\build\src\gfx\layers\composite\LayerManagerComposite.cpp:1195
[task 2019-12-23T18:52:45.197Z] 18:52:45 INFO - GECKO(10312) | #14 0x7ff969b58806 in mozilla::layers::LayerManagerComposite::Render(class mozilla::gfx::IntRegionTyped<struct mozilla::gfx::UnknownUnits> const &,class mozilla::gfx::IntRegionTyped<struct mozilla::gfx::UnknownUnits> const &) z:\build\build\src\gfx\layers\composite\LayerManagerComposite.cpp:1253
[task 2019-12-23T18:52:45.197Z] 18:52:45 INFO - GECKO(10312) | #15 0x7ff969b545da in mozilla::layers::LayerManagerComposite::UpdateAndRender(void) z:\build\build\src\gfx\layers\composite\LayerManagerComposite.cpp:645
[task 2019-12-23T18:52:45.198Z] 18:52:45 INFO - GECKO(10312) | #16 0x7ff969b5298d in mozilla::layers::LayerManagerComposite::EndTransaction(class mozilla::TimeStamp const &,enum mozilla::layers::LayerManager::EndTransactionFlags) z:\build\build\src\gfx\layers\composite\LayerManagerComposite.cpp:564
[task 2019-12-23T18:52:45.203Z] 18:52:45 INFO - GECKO(10312) | #17 0x7ff969c2f9f2 in mozilla::layers::CompositorBridgeParent::CompositeToTarget(struct mozilla::layers::BaseTransactionId<class mozilla::VsyncIdType>,class mozilla::gfx::DrawTarget *,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const *) z:\build\build\src\gfx\layers\ipc\CompositorBridgeParent.cpp:1035
[task 2019-12-23T18:52:45.203Z] 18:52:45 INFO - GECKO(10312) | #18 0x7ff969c79b8a in mozilla::layers::CompositorVsyncScheduler::Composite(struct mozilla::layers::BaseTransactionId<class mozilla::VsyncIdType>,class mozilla::TimeStamp) z:\build\build\src\gfx\layers\ipc\CompositorVsyncScheduler.cpp:250
[task 2019-12-23T18:52:45.203Z] 18:52:45 INFO - GECKO(10312) | #19 0x7ff969cea5a4 in mozilla::detail::RunnableMethodImpl<class mozilla::layers::CompositorVsyncScheduler ,void ( mozilla::layers::CompositorVsyncScheduler::)(struct mozilla::layers::BaseTransactionId<class mozilla::VsyncIdType>,class mozilla::TimeStamp),1,1,struct mozilla::layers::BaseTransactionId<class mozilla::VsyncIdType>,class mozilla::TimeStamp>::Run(void) z:\build\build\src\obj-firefox\dist\include\nsThreadUtils.h:1217
[task 2019-12-23T18:52:45.203Z] 18:52:45 INFO - GECKO(10312) | #20 0x7ff9678849c3 in ?DeferOrRunPendingTask@MessageLoop@@IEAA_N$$QEAUPendingTask@1@@Z z:\build\build\src\ipc\chromium\src\base\message_loop.cc:450
[task 2019-12-23T18:52:45.203Z] 18:52:45 INFO - GECKO(10312) | #21 0x7ff9678863fe in MessageLoop::DoWork(void) z:\build\build\src\ipc\chromium\src\base\message_loop.cc:523
[task 2019-12-23T18:52:45.203Z] 18:52:45 INFO - GECKO(10312) | #22 0x7ff967855471 in base::MessagePumpForUI::DoRunLoop(void) z:\build\build\src\ipc\chromium\src\base\message_pump_win.cc:203
[task 2019-12-23T18:52:45.204Z] 18:52:45 INFO - GECKO(10312) | #23 0x7ff967857a99 in base::MessagePumpWin::Run(class base::MessagePump::Delegate *) z:\build\build\src\ipc\chromium\src\base\message_pump_win.h:79
[task 2019-12-23T18:52:45.204Z] 18:52:45 INFO - GECKO(10312) | #24 0x7ff96788375e in MessageLoop::RunHandler(void) z:\build\build\src\ipc\chromium\src\base\message_loop.cc:308
[task 2019-12-23T18:52:45.204Z] 18:52:45 INFO - GECKO(10312) | #25 0x7ff9678955d1 in base::Thread::ThreadMain(void) z:\build\build\src\ipc\chromium\src\base\thread.cc:192
[task 2019-12-23T18:52:45.204Z] 18:52:45 INFO - GECKO(10312) | #26 0x7ff9678592af in anonymous namespace'::ThreadFunc z:\build\build\src\ipc\chromium\src\base\platform_thread_win.cc:19 [task 2019-12-23T18:52:45.223Z] 18:52:45 INFO - GECKO(10312) | #27 0x7ff99c57f838 in __asan::AsanThread::ThreadStart(unsigned __int64,struct __sanitizer::atomic_uintptr_t *) Z:\task_1576855953\fetches\llvm-project\llvm\projects\compiler-rt\lib\asan\asan_thread.cc:262 [task 2019-12-23T18:52:45.223Z] 18:52:45 INFO - GECKO(10312) | #28 0x7ff9b56d3033 (C:\Windows\System32\KERNEL32.DLL+0x180013033) [task 2019-12-23T18:52:45.228Z] 18:52:45 INFO - GECKO(10312) | #29 0x7ff9a89f4d7b in patched_BaseThreadInitThunk z:\build\build\src\mozglue\dllservices\WindowsDllBlocklist.cpp:582 [task 2019-12-23T18:52:45.230Z] 18:52:45 INFO - GECKO(10312) | #30 0x7ff9b60b1460 (C:\Windows\SYSTEM32\ntdll.dll+0x180071460) [task 2019-12-23T18:52:45.230Z] 18:52:45 INFO - GECKO(10312) | 0x122c9b8bdcc0 is located 128 bytes inside of 216-byte region [0x122c9b8bdc40,0x122c9b8bdd18) [task 2019-12-23T18:52:45.230Z] 18:52:45 INFO - GECKO(10312) | freed by thread T2 here: [task 2019-12-23T18:52:45.230Z] 18:52:45 INFO - GECKO(10312) | #0 0x7ff99c574ae4 in free Z:\task_1576855953\fetches\llvm-project\llvm\projects\compiler-rt\lib\asan\asan_malloc_win.cc:85 [task 2019-12-23T18:52:45.230Z] 18:52:45 INFO - GECKO(10312) | #1 0x7ff969b962dc in mozilla::layers::ShmemTextureHost::scalar deleting destructor'(unsigned int) z:\build\build\src\gfx\layers\composite\TextureHost.cpp:1127
[task 2019-12-23T18:52:45.231Z] 18:52:45 INFO - GECKO(10312) | #2 0x7ff96960e0ba in mozilla::AtomicRefCountedWithFinalize<class mozilla::layers::TextureHost>::Release(void) z:\build\build\src\obj-firefox\dist\include\mozilla\layers\AtomicRefCountedWithFinalize.h:152
[task 2019-12-23T18:52:45.231Z] 18:52:45 INFO - GECKO(10312) | #3 0x7ff969b847e9 in mozilla::layers::ParentActor<class mozilla::layers::PTextureParent>::RecvDestroy(void) z:\build\build\src\gfx\layers\IPDLActor.h:35
[task 2019-12-23T18:52:45.231Z] 18:52:45 INFO - GECKO(10312) | #4 0x7ff968253593 in mozilla::layers::PTextureParent::OnMessageReceived(class IPC::Message const &) z:\build\build\src\obj-firefox\ipc\ipdl\PTextureParent.cpp:108
[task 2019-12-23T18:52:45.231Z] 18:52:45 INFO - GECKO(10312) | #5 0x7ff967e0e6db in mozilla::layers::PImageBridgeParent::OnMessageReceived(class IPC::Message const &) z:\build\build\src\obj-firefox\ipc\ipdl\PImageBridgeParent.cpp:328
[task 2019-12-23T18:52:45.235Z] 18:52:45 INFO - GECKO(10312) | #6 0x7ff9679391db in mozilla::ipc::MessageChannel::DispatchAsyncMessage(class mozilla::ipc::ActorLifecycleProxy *,class IPC::Message const &) z:\build\build\src\ipc\glue\MessageChannel.cpp:2212
[task 2019-12-23T18:52:45.235Z] 18:52:45 INFO - GECKO(10312) | #7 0x7ff967934d09 in ?DispatchMessage@MessageChannel@ipc@mozilla@@AEAAX$$QEAVMessage@IPC@@@Z z:\build\build\src\ipc\glue\MessageChannel.cpp:2134
[task 2019-12-23T18:52:45.236Z] 18:52:45 INFO - GECKO(10312) | #8 0x7ff967936ec6 in mozilla::ipc::MessageChannel::RunMessage(class mozilla::ipc::MessageChannel::MessageTask &) z:\build\build\src\ipc\glue\MessageChannel.cpp:1973
[task 2019-12-23T18:52:45.236Z] 18:52:45 INFO - GECKO(10312) | #9 0x7ff967937576 in mozilla::ipc::MessageChannel::MessageTask::Run(void) z:\build\build\src\ipc\glue\MessageChannel.cpp:2004
[task 2019-12-23T18:52:45.236Z] 18:52:45 INFO - GECKO(10312) | #10 0x7ff9678849c3 in ?DeferOrRunPendingTask@MessageLoop@@IEAA_N$$QEAUPendingTask@1@@Z z:\build\build\src\ipc\chromium\src\base\message_loop.cc:450
[task 2019-12-23T18:52:45.237Z] 18:52:45 INFO - GECKO(10312) | #11 0x7ff9678863fe in MessageLoop::DoWork(void) z:\build\build\src\ipc\chromium\src\base\message_loop.cc:523
[task 2019-12-23T18:52:45.237Z] 18:52:45 INFO - GECKO(10312) | #12 0x7ff967855471 in base::MessagePumpForUI::DoRunLoop(void) z:\build\build\src\ipc\chromium\src\base\message_pump_win.cc:203
[task 2019-12-23T18:52:45.237Z] 18:52:45 INFO - GECKO(10312) | #13 0x7ff967857a99 in base::MessagePumpWin::Run(class base::MessagePump::Delegate *) z:\build\build\src\ipc\chromium\src\base\message_pump_win.h:79
[task 2019-12-23T18:52:45.237Z] 18:52:45 INFO - GECKO(10312) | #14 0x7ff96788375e in MessageLoop::RunHandler(void) z:\build\build\src\ipc\chromium\src\base\message_loop.cc:308
[task 2019-12-23T18:52:45.238Z] 18:52:45 INFO - GECKO(10312) | #15 0x7ff9678955d1 in base::Thread::ThreadMain(void) z:\build\build\src\ipc\chromium\src\base\thread.cc:192
[task 2019-12-23T18:52:45.240Z] 18:52:45 INFO - GECKO(10312) | #16 0x7ff9678592af in anonymous namespace'::ThreadFunc z:\build\build\src\ipc\chromium\src\base\platform_thread_win.cc:19 [task 2019-12-23T18:52:45.240Z] 18:52:45 INFO - GECKO(10312) | #17 0x7ff99c57f838 in __asan::AsanThread::ThreadStart(unsigned __int64,struct __sanitizer::atomic_uintptr_t *) Z:\task_1576855953\fetches\llvm-project\llvm\projects\compiler-rt\lib\asan\asan_thread.cc:262 [task 2019-12-23T18:52:45.240Z] 18:52:45 INFO - GECKO(10312) | #18 0x7ff9b56d3033 (C:\Windows\System32\KERNEL32.DLL+0x180013033) [task 2019-12-23T18:52:45.241Z] 18:52:45 INFO - GECKO(10312) | #19 0x7ff9a89f4d7b in patched_BaseThreadInitThunk z:\build\build\src\mozglue\dllservices\WindowsDllBlocklist.cpp:582 [task 2019-12-23T18:52:45.241Z] 18:52:45 INFO - GECKO(10312) | #20 0x7ff9b60b1460 (C:\Windows\SYSTEM32\ntdll.dll+0x180071460) [task 2019-12-23T18:52:45.241Z] 18:52:45 INFO - GECKO(10312) | previously allocated by thread T2 here: [task 2019-12-23T18:52:45.243Z] 18:52:45 INFO - GECKO(10312) | #0 0x7ff99c574bf4 in malloc Z:\task_1576855953\fetches\llvm-project\llvm\projects\compiler-rt\lib\asan\asan_malloc_win.cc:101 [task 2019-12-23T18:52:45.243Z] 18:52:45 INFO - GECKO(10312) | #1 0x7ff9a89f16dd in moz_xmalloc z:\build\build\src\memory\mozalloc\mozalloc.cpp:52 [task 2019-12-23T18:52:45.244Z] 18:52:45 INFO - GECKO(10312) | #2 0x7ff969b79dd4 in mozilla::layers::CreateBackendIndependentTextureHost(class mozilla::layers::SurfaceDescriptor const &,class mozilla::layers::ISurfaceAllocator *,enum mozilla::layers::LayersBackend,enum mozilla::layers::TextureFlags) z:\build\build\src\gfx\layers\composite\TextureHost.cpp:307 [task 2019-12-23T18:52:45.244Z] 18:52:45 INFO - GECKO(10312) | #3 0x7ff969b7899a in mozilla::layers::TextureHost::Create(class mozilla::layers::SurfaceDescriptor const &,class mozilla::layers::ReadLockDescriptor const &,class mozilla::layers::ISurfaceAllocator *,enum mozilla::layers::LayersBackend,enum mozilla::layers::TextureFlags,class mozilla::Maybe<struct mozilla::wr::ExternalImageId> &) z:\build\build\src\gfx\layers\composite\TextureHost.cpp:178 [task 2019-12-23T18:52:45.244Z] 18:52:45 INFO - GECKO(10312) | #4 0x7ff969b783f5 in mozilla::layers::TextureHost::CreateIPDLActor(class mozilla::layers::HostIPCAllocator *,class mozilla::layers::SurfaceDescriptor const &,class mozilla::layers::ReadLockDescriptor const &,enum mozilla::layers::LayersBackend,enum mozilla::layers::TextureFlags,unsigned __int64,class mozilla::Maybe<struct mozilla::wr::ExternalImageId> const &) z:\build\build\src\gfx\layers\composite\TextureHost.cpp:125 [task 2019-12-23T18:52:45.245Z] 18:52:45 INFO - GECKO(10312) | #5 0x7ff969c9fda1 in mozilla::layers::ImageBridgeParent::AllocPTextureParent(class mozilla::layers::SurfaceDescriptor const &,class mozilla::layers::ReadLockDescriptor const &,enum mozilla::layers::LayersBackend const &,enum mozilla::layers::TextureFlags const &,unsigned __int64 const &,class mozilla::Maybe<struct mozilla::wr::ExternalImageId> const &) z:\build\build\src\gfx\layers\ipc\ImageBridgeParent.cpp:299 [task 2019-12-23T18:52:45.245Z] 18:52:45 INFO - GECKO(10312) | #6 0x7ff967e0f616 in mozilla::layers::PImageBridgeParent::OnMessageReceived(class IPC::Message const &) z:\build\build\src\obj-firefox\ipc\ipdl\PImageBridgeParent.cpp:470 [task 2019-12-23T18:52:45.245Z] 18:52:45 INFO - GECKO(10312) | #7 0x7ff9679391db in mozilla::ipc::MessageChannel::DispatchAsyncMessage(class mozilla::ipc::ActorLifecycleProxy *,class IPC::Message const &) z:\build\build\src\ipc\glue\MessageChannel.cpp:2212 [task 2019-12-23T18:52:45.246Z] 18:52:45 INFO - GECKO(10312) | #8 0x7ff967934d09 in ?DispatchMessage@MessageChannel@ipc@mozilla@@AEAAX$$QEAVMessage@IPC@@@Z z:\build\build\src\ipc\glue\MessageChannel.cpp:2134 [task 2019-12-23T18:52:45.247Z] 18:52:45 INFO - GECKO(10312) | #9 0x7ff967936ec6 in mozilla::ipc::MessageChannel::RunMessage(class mozilla::ipc::MessageChannel::MessageTask &) z:\build\build\src\ipc\glue\MessageChannel.cpp:1973 [task 2019-12-23T18:52:45.247Z] 18:52:45 INFO - GECKO(10312) | #10 0x7ff967937576 in mozilla::ipc::MessageChannel::MessageTask::Run(void) z:\build\build\src\ipc\glue\MessageChannel.cpp:2004 [task 2019-12-23T18:52:45.247Z] 18:52:45 INFO - GECKO(10312) | #11 0x7ff9678849c3 in ?DeferOrRunPendingTask@MessageLoop@@IEAA_N$$QEAUPendingTask@1@@Z z:\build\build\src\ipc\chromium\src\base\message_loop.cc:450 [task 2019-12-23T18:52:45.248Z] 18:52:45 INFO - GECKO(10312) | #12 0x7ff9678863fe in MessageLoop::DoWork(void) z:\build\build\src\ipc\chromium\src\base\message_loop.cc:523 [task 2019-12-23T18:52:45.248Z] 18:52:45 INFO - GECKO(10312) | #13 0x7ff967855471 in base::MessagePumpForUI::DoRunLoop(void) z:\build\build\src\ipc\chromium\src\base\message_pump_win.cc:203 [task 2019-12-23T18:52:45.249Z] 18:52:45 INFO - GECKO(10312) | #14 0x7ff967857a99 in base::MessagePumpWin::Run(class base::MessagePump::Delegate *) z:\build\build\src\ipc\chromium\src\base\message_pump_win.h:79 [task 2019-12-23T18:52:45.249Z] 18:52:45 INFO - GECKO(10312) | #15 0x7ff96788375e in MessageLoop::RunHandler(void) z:\build\build\src\ipc\chromium\src\base\message_loop.cc:308 [task 2019-12-23T18:52:45.250Z] 18:52:45 INFO - GECKO(10312) | #16 0x7ff9678955d1 in base::Thread::ThreadMain(void) z:\build\build\src\ipc\chromium\src\base\thread.cc:192 [task 2019-12-23T18:52:45.250Z] 18:52:45 INFO - GECKO(10312) | #17 0x7ff9678592af in anonymous namespace'::ThreadFunc z:\build\build\src\ipc\chromium\src\base\platform_thread_win.cc:19
[task 2019-12-23T18:52:45.251Z] 18:52:45 INFO - GECKO(10312) | #18 0x7ff99c57f838 in __asan::AsanThread::ThreadStart(unsigned __int64,struct __sanitizer::atomic_uintptr_t *) Z:\task_1576855953\fetches\llvm-project\llvm\projects\compiler-rt\lib\asan\asan_thread.cc:262
[task 2019-12-23T18:52:45.251Z] 18:52:45 INFO - GECKO(10312) | #19 0x7ff9b56d3033 (C:\Windows\System32\KERNEL32.DLL+0x180013033)
[task 2019-12-23T18:52:45.252Z] 18:52:45 INFO - GECKO(10312) | #20 0x7ff9a89f4d7b in patched_BaseThreadInitThunk z:\build\build\src\mozglue\dllservices\WindowsDllBlocklist.cpp:582
[task 2019-12-23T18:52:45.255Z] 18:52:45 INFO - GECKO(10312) | #21 0x7ff9b60b1460 (C:\Windows\SYSTEM32\ntdll.dll+0x180071460)
[task 2019-12-23T18:52:45.257Z] 18:52:45 INFO - GECKO(10312) | Thread T2 created by T0 here:
[task 2019-12-23T18:52:45.257Z] 18:52:45 INFO - GECKO(10312) | #0 0x7ff99c58095c in __asan_wrap_CreateThread Z:\task_1576855953\fetches\llvm-project\llvm\projects\compiler-rt\lib\asan\asan_win.cc:146
[task 2019-12-23T18:52:45.257Z] 18:52:45 INFO - GECKO(10312) | #1 0x7ff96785924c in PlatformThread::Create(unsigned __int64,class PlatformThread::Delegate *,void * *) z:\build\build\src\ipc\chromium\src\base\platform_thread_win.cc:57
[task 2019-12-23T18:52:45.258Z] 18:52:45 INFO - GECKO(10312) | #2 0x7ff967894bbb in base::Thread::StartWithOptions(struct base::Thread::Options const &) z:\build\build\src\ipc\chromium\src\base\thread.cc:97
[task 2019-12-23T18:52:45.258Z] 18:52:45 INFO - GECKO(10312) | #3 0x7ff969c55d0c in mozilla::layers::CompositorThreadHolder::CompositorThreadHolder(void) z:\build\build\src\gfx\layers\ipc\CompositorThread.cpp:43
[task 2019-12-23T18:52:45.258Z] 18:52:45 INFO - GECKO(10312) | #4 0x7ff969c560ce in mozilla::layers::CompositorThreadHolder::Start(void) z:\build\build\src\gfx\layers\ipc\CompositorThread.cpp:112
[task 2019-12-23T18:52:45.259Z] 18:52:45 INFO - GECKO(10312) | #5 0x7ff969f4c4a1 in mozilla::gfx::GPUParent::Init(unsigned long,char const *,class MessageLoop *,class IPC::Channel *) z:\build\build\src\gfx\ipc\GPUParent.cpp:133
[task 2019-12-23T18:52:45.259Z] 18:52:45 INFO - GECKO(10312) | #6 0x7ff969f5e071 in mozilla::gfx::GPUProcessImpl::Init(int,char * * const) z:\build\build\src\gfx\ipc\GPUProcessImpl.cpp:76
[task 2019-12-23T18:52:45.259Z] 18:52:45 INFO - GECKO(10312) | #7 0x7ff9742e9817 in XRE_InitChildProcess(int,char * * const,struct XREChildData const *) z:\build\build\src\toolkit\xre\nsEmbedFunctions.cpp:747
[task 2019-12-23T18:52:45.259Z] 18:52:45 INFO - GECKO(10312) | #8 0x7ff72d902142 in NS_internal_main(int,char * *,char * *) z:\build\build\src\browser\app\nsBrowserApp.cpp:303
[task 2019-12-23T18:52:45.259Z] 18:52:45 INFO - GECKO(10312) | #9 0x7ff72d901501 in wmain z:\build\build\src\toolkit\xre\nsWindowsWMain.cpp:131
[task 2019-12-23T18:52:45.259Z] 18:52:45 INFO - GECKO(10312) | #10 0x7ff72d9fcd17 in __scrt_common_main_seh f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:288
[task 2019-12-23T18:52:45.260Z] 18:52:45 INFO - GECKO(10312) | #11 0x7ff9b56d3033 (C:\Windows\System32\KERNEL32.DLL+0x180013033)
[task 2019-12-23T18:52:45.260Z] 18:52:45 INFO - GECKO(10312) | #12 0x7ff9b60b1460 (C:\Windows\SYSTEM32\ntdll.dll+0x180071460)
[task 2019-12-23T18:52:45.260Z] 18:52:45 INFO - GECKO(10312) | SUMMARY: AddressSanitizer: heap-use-after-free z:\build\build\src\gfx\layers\basic\BasicCompositor.cpp:129 in mozilla::layers::WrappingTextureSourceYCbCrBasic::GetSurface(class mozilla::gfx::DrawTarget *)
[task 2019-12-23T18:52:45.260Z] 18:52:45 INFO - GECKO(10312) | Shadow bytes around the buggy address:
[task 2019-12-23T18:52:45.260Z] 18:52:45 INFO - GECKO(10312) | 0x04502ed97b40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
[task 2019-12-23T18:52:45.261Z] 18:52:45 INFO - GECKO(10312) | 0x04502ed97b50: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2019-12-23T18:52:45.261Z] 18:52:45 INFO - GECKO(10312) | 0x04502ed97b60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
[task 2019-12-23T18:52:45.261Z] 18:52:45 INFO - GECKO(10312) | 0x04502ed97b70: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
[task 2019-12-23T18:52:45.262Z] 18:52:45 INFO - GECKO(10312) | 0x04502ed97b80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
[task 2019-12-23T18:52:45.262Z] 18:52:45 INFO - GECKO(10312) | =>0x04502ed97b90: fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd
[task 2019-12-23T18:52:45.262Z] 18:52:45 INFO - GECKO(10312) | 0x04502ed97ba0: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2019-12-23T18:52:45.262Z] 18:52:45 INFO - GECKO(10312) | 0x04502ed97bb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
[task 2019-12-23T18:52:45.262Z] 18:52:45 INFO - GECKO(10312) | 0x04502ed97bc0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
[task 2019-12-23T18:52:45.262Z] 18:52:45 INFO - GECKO(10312) | 0x04502ed97bd0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
[task 2019-12-23T18:52:45.262Z] 18:52:45 INFO - GECKO(10312) | 0x04502ed97be0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
[task 2019-12-23T18:52:45.263Z] 18:52:45 INFO - GECKO(10312) | Shadow byte legend (one shadow byte represents 8 application bytes):
[task 2019-12-23T18:52:45.263Z] 18:52:45 INFO - GECKO(10312) | Addressable: 00
[task 2019-12-23T18:52:45.263Z] 18:52:45 INFO - GECKO(10312) | Partially addressable: 01 02 03 04 05 06 07
[task 2019-12-23T18:52:45.263Z] 18:52:45 INFO - GECKO(10312) | Heap left redzone: fa
[task 2019-12-23T18:52:45.263Z] 18:52:45 INFO - GECKO(10312) | Freed heap region: fd
[task 2019-12-23T18:52:45.263Z] 18:52:45 INFO - GECKO(10312) | Stack left redzone: f1
[task 2019-12-23T18:52:45.264Z] 18:52:45 INFO - GECKO(10312) | Stack mid redzone: f2
[task 2019-12-23T18:52:45.264Z] 18:52:45 INFO - GECKO(10312) | Stack right redzone: f3
[task 2019-12-23T18:52:45.264Z] 18:52:45 INFO - GECKO(10312) | Stack after return: f5
[task 2019-12-23T18:52:45.264Z] 18:52:45 INFO - GECKO(10312) | Stack use after scope: f8
[task 2019-12-23T18:52:45.264Z] 18:52:45 INFO - GECKO(10312) | Global redzone: f9
[task 2019-12-23T18:52:45.264Z] 18:52:45 INFO - GECKO(10312) | Global init order: f6
[task 2019-12-23T18:52:45.265Z] 18:52:45 INFO - GECKO(10312) | Poisoned by user: f7
[task 2019-12-23T18:52:45.265Z] 18:52:45 INFO - GECKO(10312) | Container overflow: fc
[task 2019-12-23T18:52:45.265Z] 18:52:45 INFO - GECKO(10312) | Array cookie: ac
[task 2019-12-23T18:52:45.265Z] 18:52:45 INFO - GECKO(10312) | Intra object redzone: bb
[task 2019-12-23T18:52:45.265Z] 18:52:45 INFO - GECKO(10312) | ASan internal: fe
[task 2019-12-23T18:52:45.265Z] 18:52:45 INFO - GECKO(10312) | Left alloca redzone: ca
[task 2019-12-23T18:52:45.265Z] 18:52:45 INFO - GECKO(10312) | Right alloca redzone: cb
[task 2019-12-23T18:52:45.265Z] 18:52:45 INFO - GECKO(10312) | Shadow gap: cc
[task 2019-12-23T18:52:45.266Z] 18:52:45 INFO - GECKO(10312) | ==5364==ABORTING

Group: core-security → gfx-core-security

Jeff, any suggestions for this bug?

Flags: needinfo?(jmuizelaar)

It looks like the test was toolkit/components/pictureinpicture/tests/browser_disabledForMediaStreamVideos.js. Sotaro, any guesses what could be going wrong here?

Flags: needinfo?(jmuizelaar) → needinfo?(sotaro.ikeda.g)
Assignee: nobody → sotaro.ikeda.g
Flags: needinfo?(sotaro.ikeda.g)

#0 0x7ff9695723fe in mozilla::layers::WrappingTextureSourceYCbCrBasic::GetSurface(class mozilla::gfx::DrawTarget *) z:\build\build\src\gfx\layers\basic\BasicCompositor.cpp:129

It means that mTexture is already destroyed. mTexture is hold as raw pointer to avoid mutual reference.

BufferTextureHost* mTexture

https://searchfox.org/mozilla-central/rev/cfd1cc461f1efe0d66c2fdc17c024a203d5a2fd8/gfx/layers/basic/BasicCompositor.cpp#129
https://searchfox.org/mozilla-central/rev/cfd1cc461f1efe0d66c2fdc17c024a203d5a2fd8/gfx/layers/basic/BasicCompositor.cpp#178

BufferTextureHost::DeallocateDeviceData() seems to have a problem.

https://searchfox.org/mozilla-central/rev/cfd1cc461f1efe0d66c2fdc17c024a203d5a2fd8/gfx/layers/composite/TextureHost.cpp#556

When mFirstSource is WrappingTextureSourceYCbCrBasic, we should call mFirstSource->SetOwner(nullptr) to avoid use after free.

Comment on attachment 9122282 [details]
Bug 1605777 - Clear WrappingTextureSourceYCbCrBasic::mTexture correctly

Security Approval Request

  • How easily could an exploit be constructed based on the patch?: It is hard. It rarely happend during the tests. And content side could not control it could happen.
  • Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
  • Which older supported branches are affected by this flaw?: firefox50
  • If not all supported branches, which bug introduced the flaw?: Bug 1254011
  • Do you have backports for the affected branches?: No
  • If not, how different, hard to create, and risky will they be?: It is easy to create backports.
  • How likely is this patch to cause regressions; how much testing does it need?: It is not likely to cause a regression.
Attachment #9122282 - Flags: sec-approval?

Comment on attachment 9122282 [details]
Bug 1605777 - Clear WrappingTextureSourceYCbCrBasic::mTexture correctly

Approved to land and request uplift. In the future, if you could explain why it is hard that would be appreciated.

Attachment #9122282 - Flags: sec-approval? → sec-approval+

https://hg.mozilla.org/integration/autoland/rev/e3b1a0aa6b1a55687e5aadcc5a419def3d76f326
https://hg.mozilla.org/mozilla-central/rev/e3b1a0aa6b1a

Group: gfx-core-security → core-security-release
Status: NEW → RESOLVED
Closed: 6 years ago
status-firefox74: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla74

Sounds like this need an uplift request ASAP. We're in RC week.

status-firefox72: --- → wontfix
status-firefox73: --- → affected
status-firefox-esr68: --- → affected
tracking-firefox73: --- → +
tracking-firefox74: --- → +
tracking-firefox-esr68: --- → 73+
Flags: needinfo?(sotaro.ikeda.g)

Per discussion with Tom, we're going to build the RCs today without this patch but will leave it on the radar in the event of a respin later this week.

Comment on attachment 9122282 [details]
Bug 1605777 - Clear WrappingTextureSourceYCbCrBasic::mTexture correctly

Beta/Release Uplift Approval Request

  • User impact if declined: Crash could happen during playing video with BasicCompositor
  • Is this code covered by automated tests?: Yes
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: none
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): The change just added a check for preventing uaf.
  • String changes made/needed: none
Flags: needinfo?(sotaro.ikeda.g)
Attachment #9122282 - Flags: approval-mozilla-beta?

Comment on attachment 9122282 [details]
Bug 1605777 - Clear WrappingTextureSourceYCbCrBasic::mTexture correctly

ESR Uplift Approval Request

  • If this is not a sec:{high,crit} bug, please state case for ESR consideration:
  • User impact if declined: Crash could happen during playing video with BasicCompositor(software composite)
  • Fix Landed on Version: 74
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): The change is not risky. It just added a check for preventing uaf.
  • String or UUID changes made by this patch: none
Attachment #9122282 - Flags: approval-mozilla-esr68?
Attachment #9122282 - Flags: approval-mozilla-beta? → approval-mozilla-release?
Whiteboard: [adv-main73+r][adv-esr68.5+r]

Comment on attachment 9122282 [details]
Bug 1605777 - Clear WrappingTextureSourceYCbCrBasic::mTexture correctly

Fixes a sec bug. Approved for 73.0 and 68.5esr RC2.

Attachment #9122282 - Flags: approval-mozilla-release?
Attachment #9122282 - Flags: approval-mozilla-release+
Attachment #9122282 - Flags: approval-mozilla-esr68?
Attachment #9122282 - Flags: approval-mozilla-esr68+
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: