1748438 - Crash [@ mozilla::dom::ImageBitmapRenderingContext::GetImageBuffer]

Status: VERIFIED FIXED

(Core :: Graphics: Canvas2D, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 8bc2581b2c7b (built with: --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 8bc2581b2c7b --asan --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.zip

[@ mozilla::dom::ImageBitmapRenderingContext::GetImageBuffer]

    =================================================================
    ==1860167==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fb0619dba94 bp 0x7ffc98e47a10 sp 0x7ffc98e47900 T0)
    ==1860167==The signal is caused by a READ memory access.
    ==1860167==Hint: address points to the zero page.
        #0 0x7fb0619dba94 in mozilla::dom::ImageBitmapRenderingContext::GetImageBuffer(int*) /dom/canvas/ImageBitmapRenderingContext.cpp:141:50
        #1 0x7fb0619dc282 in mozilla::dom::ImageBitmapRenderingContext::GetInputStream(char const*, nsTSubstring<char16_t> const&, nsIInputStream**) /dom/canvas/ImageBitmapRenderingContext.cpp:169:38
        #2 0x7fb05fa5822a in mozilla::dom::ImageEncoder::ExtractDataInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, unsigned char*, int, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits>, bool, mozilla::layers::Image*, nsICanvasRenderingContextInternal*, mozilla::layers::CanvasRenderer*, nsIInputStream**, imgIEncoder*) /dom/base/ImageEncoder.cpp:313:20
        #3 0x7fb05fa56e5b in mozilla::dom::ImageEncoder::ExtractData(nsTSubstring<char16_t>&, nsTSubstring<char16_t> const&, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits>, bool, nsICanvasRenderingContextInternal*, mozilla::layers::CanvasRenderer*, nsIInputStream**) /dom/base/ImageEncoder.cpp:227:10
        #4 0x7fb062278e31 in mozilla::dom::HTMLCanvasElement::ExtractData(JSContext*, nsIPrincipal&, nsTSubstring<char16_t>&, nsTSubstring<char16_t> const&, nsIInputStream**) /dom/html/HTMLCanvasElement.cpp:736:10
        #5 0x7fb06227734b in mozilla::dom::HTMLCanvasElement::ToDataURLImpl(JSContext*, nsIPrincipal&, nsTSubstring<char16_t> const&, JS::Value const&, nsTSubstring<char16_t>&) /dom/html/HTMLCanvasElement.cpp:764:7
        #6 0x7fb062276c87 in mozilla::dom::HTMLCanvasElement::ToDataURL(JSContext*, nsTSubstring<char16_t> const&, JS::Handle<JS::Value>, nsTSubstring<char16_t>&, nsIPrincipal&, mozilla::ErrorResult&) /dom/html/HTMLCanvasElement.cpp:612:17
        #7 0x7fb0615acb4c in mozilla::dom::HTMLCanvasElement_Binding::toDataURL(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/HTMLCanvasElementBinding.cpp:618:24
        #8 0x7fb0617a87ad in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3306:13
        #9 0x7fb0692cbb44 in CallJSNative /js/src/vm/Interpreter.cpp:425:13
        #10 0x7fb0692cbb44 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:512:12
        #11 0x7fb0692b800e in CallFromStack /js/src/vm/Interpreter.cpp:576:10
        #12 0x7fb0692b800e in Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3309:16
        #13 0x7fb06929ce11 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:394:13
        #14 0x7fb0692cbc7f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:544:13
        #15 0x7fb0692cddcb in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:589:8
        #16 0x7fb069867307 in js::CallSelfHostedFunction(JSContext*, JS::Handle<js::PropertyName*>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /js/src/vm/SelfHosting.cpp:1539:10
        #17 0x7fb0695154e9 in AsyncFunctionResume(JSContext*, JS::Handle<js::AsyncFunctionGeneratorObject*>, ResumeKind, JS::Handle<JS::Value>) /js/src/vm/AsyncFunction.cpp:152:8
        #18 0x7fb0696c5c7a in AsyncFunctionPromiseReactionJob /js/src/builtin/Promise.cpp:1949:12
        #19 0x7fb0696c5c7a in PromiseReactionJob(JSContext*, unsigned int, JS::Value*) /js/src/builtin/Promise.cpp:2012:12
        #20 0x7fb0692cbb44 in CallJSNative /js/src/vm/Interpreter.cpp:425:13
        #21 0x7fb0692cbb44 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:512:12
        #22 0x7fb0692cddcb in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:589:8
        #23 0x7fb06954c17d in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:117:10
        #24 0x7fb060592c2c in mozilla::dom::PromiseJobCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/PromiseBinding.cpp:35:8
        #25 0x7fb05bebbed7 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:89:12
        #26 0x7fb05bebbed7 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:102:12
        #27 0x7fb05bebbed7 in mozilla::PromiseJobRunnable::Run(mozilla::AutoSlowOperation&) /xpcom/base/CycleCollectedJSContext.cpp:213:18
        #28 0x7fb05be9ad47 in mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool) /xpcom/base/CycleCollectedJSContext.cpp:674:17
        #29 0x7fb05be9bd2f in mozilla::CycleCollectedJSContext::AfterProcessTask(unsigned int) /xpcom/base/CycleCollectedJSContext.cpp:463:3
        #30 0x7fb05e4b9fe6 in XPCJSContext::AfterProcessTask(unsigned int) /js/xpconnect/src/XPCJSContext.cpp:1424:28
        #31 0x7fb05c0dcd58 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1220:24
        #32 0x7fb05c0e7e6c in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:467:10
        #33 0x7fb05d5fb98f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #34 0x7fb05d47ae81 in RunInternal /ipc/chromium/src/base/message_loop.cc:331:10
        #35 0x7fb05d47ae81 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
        #36 0x7fb05d47ae81 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
        #37 0x7fb06438ce17 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:137:27
        #38 0x7fb068fe96af in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:864:20
        #39 0x7fb05d47ae81 in RunInternal /ipc/chromium/src/base/message_loop.cc:331:10
        #40 0x7fb05d47ae81 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
        #41 0x7fb05d47ae81 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
        #42 0x7fb068fe88e2 in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:701:34
        #43 0x555f542fc08d in content_process_main(mozilla::Bootstrap*, int, char**) /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #44 0x555f542fc4b8 in main /browser/app/nsBrowserApp.cpp:327:18
        #45 0x7fb0806b80b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
        #46 0x555f5424b159 in _start (/home/jkratzer/builds/mc-asan/firefox+0x5d159)
    
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV /dom/canvas/ImageBitmapRenderingContext.cpp:141:50 in mozilla::dom::ImageBitmapRenderingContext::GetImageBuffer(int*)
    ==1860167==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220104034109-8bc2581b2c7b.
Failed to bisect testcase (Testcase reproduces on start build!):

Start: 1d89f3cb5bb3e5a37b0249977838c4a98c162c80 (20210105043131)
End: 8bc2581b2c7bb99a1138ece1f6e7bf80ff7f79d3 (20220104034109)
BuildFlags: BuildFlags(asan=True, tsan=False, debug=False, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False)

Comment 3

[Timothy Nikkel (:tnikkel)]

One of these prefs from the included prefs is required to reproduce
user_pref("security.OCSP.enabled", 0);
user_pref("security.data_uri.unique_opaque_origin", false);
user_pref("security.default_personal_cert", "Select Automatically");
user_pref("security.fileuri.strict_origin_policy", false);
user_pref("security.sandbox.content.tempDirSuffix", "dbc378c3-8e56-4fb6-b226-05a0620401e4");
user_pref("security.webauth.webauthn_enable_softtoken", true);
user_pref("security.webauth.webauthn_enable_usbtoken", false);

Comment 4

[Dzmitry Malyshau [:kvark]]

Timothy or Lee (given that it originates in HTMLCanvasElement), would you want to investigate further?

Comment 5

[Lee Salzman [:lsalzman]]

Attachment: Bug 1748438 - Check for null surface in ImageBitmapRenderingContext::GetImageBuffer. r?aosmond

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7fc30867f03d
Check for null surface in ImageBitmapRenderingContext::GetImageBuffer. r=aosmond

Comment 7

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/7fc30867f03d

Comment 8

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220107034910-611ec542121f.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

:lsalzman, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

Comment 10

[Marco Castelluccio [:marco]]

Sorry, bug in the bot.