1640042 - null pointer passed as argument 2, which is declared to never be null in security/nss/lib/ssl/sslsock.c:4460

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Tyson Smith [:tsmith]]

To enable this check add the following to your mozconfig:

ac_add_options --enable-undefined-sanitizer="nonnull-attribute"

This can reproduced by launching the browser:

src/security/nss/lib/ssl/sslsock.c:4460:38: runtime error: null pointer passed as argument 2, which is declared to never be null
/usr/include/string.h:43:28: note: nonnull attribute specified here
    #0 0x7f53c8fa533b in SSLExp_GetResumptionTokenInfo src/security/nss/lib/ssl/sslsock.c:4460:5
    #1 0x7f53aa34154e in mozilla::net::SSLTokensCache::Put(nsTSubstring<char> const&, unsigned char const*, unsigned int, nsITransportSecurityInfo*) src/netwerk/base/SSLTokensCache.cpp:144:7
    #2 0x7f53b4cc4fb7 in StoreResumptionToken(PRFileDesc*, unsigned char const*, unsigned int, void*) src/security/manager/ssl/nsNSSIOLayer.cpp:2764:7
    #3 0x7f53c8f8c43b in ssl_CacheExternalToken src/security/nss/lib/ssl/sslnonce.c:1112:20
    #4 0x7f53c8f58aa1 in ssl3_FinishHandshake src/security/nss/lib/ssl/ssl3con.c:11896:9
    #5 0x7f53c8f5fa01 in ssl3_HandleFinished src/security/nss/lib/ssl/ssl3con.c:11819:10
    #6 0x7f53c8f5fa01 in ssl3_HandlePostHelloHandshakeMessage src/security/nss/lib/ssl/ssl3con.c:12173:18
    #7 0x7f53c8f5ae68 in ssl3_HandleHandshakeMessage src/security/nss/lib/ssl/ssl3con.c:12057:22
    #8 0x7f53c8f610f4 in ssl3_HandleHandshake src/security/nss/lib/ssl/ssl3con.c:12231:18
    #9 0x7f53c8f610f4 in ssl3_HandleNonApplicationData src/security/nss/lib/ssl/ssl3con.c:12756:22
    #10 0x7f53c8f62b9f in ssl3_HandleRecord src/security/nss/lib/ssl/ssl3con.c:13047:12
    #11 0x7f53c8f7dd4c in ssl3_GatherCompleteHandshake src/security/nss/lib/ssl/ssl3gthr.c:523:18
    #12 0x7f53c8f7ee0a in ssl3_GatherAppDataRecord src/security/nss/lib/ssl/ssl3gthr.c:608:14
    #13 0x7f53c8f911f8 in DoRecv src/security/nss/lib/ssl/sslsecur.c:484:14
    #14 0x7f53c8f911f8 in ssl_SecureRecv src/security/nss/lib/ssl/sslsecur.c:828:10
    #15 0x7f53c8fa96c4 in ssl_Recv src/security/nss/lib/ssl/sslsock.c:3105:10
    #16 0x7f53b4cba258 in PSMRecv(PRFileDesc*, void*, int, int, unsigned int) src/security/manager/ssl/nsNSSIOLayer.cpp:1242:7
    #17 0x7f53aa4188de in mozilla::net::nsSocketInputStream::Read(char*, unsigned int, unsigned int*) src/netwerk/base/nsSocketTransport2.cpp:381:15
    #18 0x7f53aaeea7c6 in mozilla::net::nsHttpConnection::OnWriteSegment(char*, unsigned int, unsigned int*) src/netwerk/protocol/http/nsHttpConnection.cpp:2088:28
    #19 0x7f53aaf43749 in mozilla::net::nsHttpTransaction::WritePipeSegment(nsIOutputStream*, void*, char*, unsigned int, unsigned int, unsigned int*) src/netwerk/protocol/http/nsHttpTransaction.cpp:844:24
    #20 0x7f53aa023cf1 in nsPipeOutputStream::WriteSegments(nsresult (*)(nsIOutputStream*, void*, char*, unsigned int, unsigned int, unsigned int*), void*, unsigned int, unsigned int*) src/xpcom/io/nsPipe3.cpp:1684:12
    #21 0x7f53aaf44f85 in mozilla::net::nsHttpTransaction::WriteSegments(mozilla::net::nsAHttpSegmentWriter*, unsigned int, unsigned int*) src/netwerk/protocol/http/nsHttpTransaction.cpp:969:17
    #22 0x7f53aaeeae33 in mozilla::net::nsHttpConnection::OnSocketReadable() src/netwerk/protocol/http/nsHttpConnection.cpp:2153:24
    #23 0x7f53aaeed448 in mozilla::net::nsHttpConnection::OnInputStreamReady(nsIAsyncInputStream*) src/netwerk/protocol/http/nsHttpConnection.cpp:2506:17
    #24 0x7f53aaeeda7f in non-virtual thunk to mozilla::net::nsHttpConnection::OnInputStreamReady(nsIAsyncInputStream*) src/netwerk/protocol/http/nsHttpConnection.cpp
    #25 0x7f53aa417649 in mozilla::net::nsSocketInputStream::OnSocketReady(nsresult) src/netwerk/base/nsSocketTransport2.cpp:286:27
    #26 0x7f53aa42735f in mozilla::net::nsSocketTransport::OnSocketReady(PRFileDesc*, short) src/netwerk/base/nsSocketTransport2.cpp:2280:14
    #27 0x7f53aa438d9d in mozilla::net::nsSocketTransportService::DoPollIteration(mozilla::BaseTimeDuration<mozilla::TimeDurationValueCalculator>*) src/netwerk/base/nsSocketTransportService2.cpp
    #28 0x7f53aa437618 in mozilla::net::nsSocketTransportService::Run() src/netwerk/base/nsSocketTransportService2.cpp:1094:7
    #29 0x7f53aa4395ac in non-virtual thunk to mozilla::net::nsSocketTransportService::Run() src/netwerk/base/nsSocketTransportService2.cpp
    #30 0x7f53aa0e4815 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1211:14
    #31 0x7f53aa0ecbfc in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:501:10
    #32 0x7f53ab3991f9 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:302:20
    #33 0x7f53ab259707 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
    #34 0x7f53ab259707 in MessageLoop::RunHandler() src/ipc/chromium/src/base/message_loop.cc:308:3
    #35 0x7f53ab259707 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
    #36 0x7f53aa0deace in nsThread::ThreadFunc(void*) src/xpcom/threads/nsThread.cpp:444:10
    #37 0x7f53ce15b7b7 in _pt_root src/nsprpub/pr/src/pthreads/ptthread.c:201:5
    #38 0x7f53cdda96da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
    #39 0x7f53ccd8788e in clone /build/glibc-OTsEL5/glibc-2.27/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Comment 1

[Martin Thomson [:mt:]]

Attachment: Bug 1640042 - Don't memcpy nothing, r?jcj

Comment 2

[Kevin Jacobs [:kjacobs]]

https://hg.mozilla.org/projects/nss/rev/1a634da46b875c11bf53313ce2b801896a45b265

Comment 3

[(Away)]

Just to connect the dots: this was merged from the nss repo to m-c in bug 1636656.