1741760 - breakpad-client writes random garbage into invalid code_ids

Status: RESOLVED FIXED

(Toolkit :: Crash Reporting, defect)

Description

[Aria Beingessner [:Gankra]]

See https://github.com/luser/rust-minidump/issues/283#issuecomment-965625837 for details.

According to Ted's description, this reads uninitialized memory from breakpad-client's stack, so, not great! But not really a security concern in this context. Just annoying/sloppy.

Presumably not an issue with the rust-based rewrites.

(Ted describes the issue for Linux, but every module on macos gets similarly "weird" code_ids. Not sure if it's the same root cause or if macos is just trying to provide some other piece of information that breakpad doesn't understand. All I know is that both platforms get the "haunted" code_ids described in the issue.)

Comment 1

[Gabriele Svelto [:gsvelto]]

Note: this should only affect main process crashes ATM but given the fix is simple let's do it here before we move crash generation entirely OOP.

Comment 2

[Gabriele Svelto [:gsvelto]]

Attachment: Bug 1741760 - Don't write garbage code IDs for modules that aren't ELF files r=Gankra

I'm being extra-defensive here: we're not resizing the vector that is supposed
to hold the UUID until we're sure we can fill it and we're also explicitly
clearing it in case LinuxDumper::ElfFileIdentifierForMapping() returns
false. This should cover all possible cases.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ab49951226fa
Don't write garbage code IDs for modules that aren't ELF files r=Gankra

Comment 4

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/ab49951226fa