1633828 - pointer index expression overflow in [@ nsFind::DecodeChar]

Status: RESOLVED FIXED

(Toolkit :: Find Toolbar, defect, P2)

Description

[Tyson Smith [:tsmith]]

Found with m-c 20200428-a99c73301874

/gecko/toolkit/components/find/nsFind.cpp:437:16: runtime error: pointer index expression with base 0x000000000000 overflowed to 0xfffffffffffffffe
    #0 0x7fa8e693b64e in nsFind::DecodeChar(char16_t const*, int*) const /gecko/toolkit/components/find/nsFind.cpp:437:16
    #1 0x7fa8e693bc08 in nsFind::PeekNextChar(nsFind::State&) const /gecko/toolkit/components/find/nsFind.cpp:508:46
    #2 0x7fa8e693d069 in nsFind::Find(nsTSubstring<char16_t> const&, nsRange*, nsRange*, nsRange*, nsRange**) /gecko/toolkit/components/find/nsFind.cpp:829:24
    #3 0x7fa8e6940a2b in nsWebBrowserFind::SearchInFrame(nsPIDOMWindowOuter*, bool, bool*) /gecko/toolkit/components/find/nsWebBrowserFind.cpp:660:14
    #4 0x7fa8e693ed37 in nsWebBrowserFind::FindNext(bool*) /gecko/toolkit/components/find/nsWebBrowserFind.cpp:106:8
    #5 0x7fa8deaf2053 in nsGlobalWindowOuter::FindOuter(nsTSubstring<char16_t> const&, bool, bool, bool, bool, bool, bool, mozilla::ErrorResult&) /gecko/dom/base/nsGlobalWindowOuter.cpp:6574:20
    #6 0x7fa8e01d47cb in mozilla::dom::Window_Binding::find(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/WindowBinding.cpp:6409:36
    #7 0x7fa8e09fdf05 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeCrossOriginObjectThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /gecko/dom/bindings/BindingUtils.cpp:3203:13
    #8 0x7fa8e6ff332b in CallJSNative /gecko/js/src/vm/Interpreter.cpp:493:13
    #9 0x7fa8e6ff332b in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:585:12
    #10 0x7fa8e6ff557a in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:648:10
    #11 0x7fa8e6fdbd7f in CallFromStack /gecko/js/src/vm/Interpreter.cpp:652:10
    #12 0x7fa8e6fdbd7f in Interpret(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:3323:16
    #13 0x7fa8e6fbf0fe in js::RunScript(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:465:10
    #14 0x7fa8e6ff340d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:620:13
    #15 0x7fa8e6ff557a in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:648:10
    #16 0x7fa8e6ff5856 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:665:8
    #17 0x7fa8e7197f20 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /gecko/js/src/jsapi.cpp:2833:10
    #18 0x7fa8e05ecb39 in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventHandlerBinding.cpp:276:37
    #19 0x7fa8e111acbe in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:367:12
    #20 0x7fa8e1118f2a in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /gecko/dom/events/JSEventHandler.cpp:201:12
    #21 0x7fa8e10dd16e in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /gecko/dom/events/EventListenerManager.cpp:1079:22
    #22 0x7fa8e10de7e7 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /gecko/dom/events/EventListenerManager.cpp:1271:17
    #23 0x7fa8e10ccb0f in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /gecko/dom/events/EventDispatcher.cpp:356:17
    #24 0x7fa8e10cb2ad in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /gecko/dom/events/EventDispatcher.cpp:558:16
    #25 0x7fa8e10cf836 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /gecko/dom/events/EventDispatcher.cpp:1055:11
    #26 0x7fa8e37a169e in nsDocumentViewer::LoadComplete(nsresult) /gecko/layout/base/nsDocumentViewer.cpp:1145:7
    #27 0x7fa8e632c0db in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /gecko/docshell/base/nsDocShell.cpp:5904:20
    #28 0x7fa8e632b285 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /gecko/docshell/base/nsDocShell.cpp:5647:7
    #29 0x7fa8e6330cbf in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /gecko/docshell/base/nsDocShell.cpp
    #30 0x7fa8dd75b240 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /gecko/uriloader/base/nsDocLoader.cpp:1345:3
    #31 0x7fa8dd75a20c in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /gecko/uriloader/base/nsDocLoader.cpp:905:14
    #32 0x7fa8dd7564e0 in nsDocLoader::DocLoaderIsEmpty(bool) /gecko/uriloader/base/nsDocLoader.cpp:725:9
    #33 0x7fa8dd758d13 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /gecko/uriloader/base/nsDocLoader.cpp:613:5
    #34 0x7fa8dd759d9c in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /gecko/uriloader/base/nsDocLoader.cpp
    #35 0x7fa8db007fa7 in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /gecko/netwerk/base/nsLoadGroup.cpp:610:22
    #36 0x7fa8db00b1b7 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /gecko/netwerk/base/nsLoadGroup.cpp:517:10
    #37 0x7fa8decc11bf in mozilla::dom::Document::DoUnblockOnload() /gecko/dom/base/Document.cpp:10723:18
    #38 0x7fa8dec774f6 in mozilla::dom::Document::UnblockOnload(bool) /gecko/dom/base/Document.cpp:10655:9
    #39 0x7fa8e107400b in mozilla::LoadBlockingAsyncEventDispatcher::~LoadBlockingAsyncEventDispatcher() /gecko/dom/events/AsyncEventDispatcher.cpp:117:18
    #40 0x7fa8e10740ad in mozilla::LoadBlockingAsyncEventDispatcher::~LoadBlockingAsyncEventDispatcher() /gecko/dom/events/AsyncEventDispatcher.cpp:115:71
    #41 0x7fa8dad808bc in Release /gecko/xpcom/threads/nsThreadUtils.cpp:54:1
    #42 0x7fa8dad808bc in mozilla::CancelableRunnable::Release() /gecko/xpcom/threads/nsThreadUtils.cpp:76:1
    #43 0x7fa8dad34c48 in ~nsCOMPtr_base /builds/worker/workspace/obj-build/dist/include/nsCOMPtr.h:329:7
    #44 0x7fa8dad34c48 in mozilla::SchedulerGroup::Runnable::Run() /gecko/xpcom/threads/SchedulerGroup.cpp:147:1
    #45 0x7fa8dad6d796 in nsThread::ProcessNextEvent(bool, bool*) /gecko/xpcom/threads/nsThread.cpp:1200:14
    #46 0x7fa8dad77efc in NS_ProcessNextEvent(nsIThread*, bool) /gecko/xpcom/threads/nsThreadUtils.cpp:481:10
    #47 0x7fa8dc08442f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /gecko/ipc/glue/MessagePump.cpp:87:21
    #48 0x7fa8dbf71457 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:315:10
    #49 0x7fa8dbf71457 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:308:3
    #50 0x7fa8dbf71457 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:290:3
    #51 0x7fa8e31daf48 in nsBaseAppShell::Run() /gecko/widget/nsBaseAppShell.cpp:137:27
    #52 0x7fa8e6d92736 in XRE_RunAppShell() /gecko/toolkit/xre/nsEmbedFunctions.cpp:909:20
    #53 0x7fa8dbf71457 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:315:10
    #54 0x7fa8dbf71457 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:308:3
    #55 0x7fa8dbf71457 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:290:3
    #56 0x7fa8e6d91dea in XRE_InitChildProcess(int, char**, XREChildData const*) /gecko/toolkit/xre/nsEmbedFunctions.cpp:740:34
    #57 0x558e126ecbd3 in content_process_main /gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #58 0x558e126ecbd3 in main /gecko/browser/app/nsBrowserApp.cpp:303:18
    #59 0x7fa8fe080b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    #60 0x558e1264152c in _start (/home/worker/builds/m-c-20200428100141-fuzzing-asan-opt/firefox+0xa352c)

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/lwxnIqJFEgOwMl67KN33JA/index.html

Comment 2

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1633828 - Check for empty text nodes in nsFind::PeekNextChar. r=jfkthame

This check was done in GetNextNonEmptyTextFragmentInSameBlock which I
removed in bug 1627643.

Hopefully the fuzzer finds an easy reduced test-case to land as a
crashtest, otherwise I can try to construct one.

Comment 3

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1627643

Comment 5

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1633828 - crashtest.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/54553700d61d
Check for empty text nodes in nsFind::PeekNextChar. r=jfkthame

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0f9c5a59e45d
crashtest.

Comment 8

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/54553700d61d
https://hg.mozilla.org/mozilla-central/rev/0f9c5a59e45d