1766647 - Crash [@ bool AssignJSString<nsTString<char>, (void*)0>]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Christian Holler (:decoder)]

The attached testcase crashes on mozilla-central revision 20220425-9cb38db713cc.

Backtrace:

==1177==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f0d30bc7986 bp 0x7fff19ff71d0 sp 0x7fff19ff6fa0 T0)
    #0 0x7f0d30bc7986 in bool AssignJSString<nsTString<char>, (void*)0>(JSContext*, nsTString<char>&, JSString*) dist/include/mozilla/CheckedInt.h
    #1 0x7f0d30e35da8 in mozilla::dom::ReadAsCString(JSContext*, JSStructuredCloneReader*, nsTString<char>&) /dom/base/DOMException.cpp:420:10
    #2 0x7f0d30e35963 in mozilla::dom::DOMException::ReadStructuredClone(JSContext*, nsIGlobalObject*, JSStructuredCloneReader*) /dom/base/DOMException.cpp:433:8
    #3 0x7f0d32854e75 in mozilla::dom::DOMException_Binding::Deserialize(JSContext*, nsIGlobalObject*, JSStructuredCloneReader*) /builds/worker/workspace/obj-build/dom/bindings/DOMExceptionBinding.cpp:740:46
    #4 0x7f0d3117410b in mozilla::dom::StructuredCloneHolder::ReadFullySerializableObjects(JSContext*, JSStructuredCloneReader*, unsigned int) /dom/base/StructuredCloneHolder.cpp:430:12
    #5 0x7f0d31176adb in mozilla::dom::StructuredCloneHolder::CustomReadHandler(JSContext*, JSStructuredCloneReader*, JS::CloneDataPolicy const&, unsigned int, unsigned int) /dom/base/StructuredCloneHolder.cpp:1008:10
    #6 0x7f0d3b2f0566 in JSStructuredCloneReader::startRead(JS::MutableHandle<JS::Value>, js::gc::InitialHeap) /js/src/vm/StructuredClone.cpp:2844:11
    #7 0x7f0d3b2d9394 in JSStructuredCloneReader::read(JS::MutableHandle<JS::Value>, unsigned long) /js/src/vm/StructuredClone.cpp:3261:8
    #8 0x7f0d3b2d89d7 in ReadStructuredClone(JSContext*, JSStructuredCloneData const&, JS::StructuredCloneScope, JS::MutableHandle<JS::Value>, JS::CloneDataPolicy const&, JSStructuredCloneCallbacks const*, void*) /js/src/vm/StructuredClone.cpp:721:12
    #9 0x7f0d3b2f885e in JS_ReadStructuredClone(JSContext*, JSStructuredCloneData const&, unsigned int, JS::StructuredCloneScope, JS::MutableHandle<JS::Value>, JS::CloneDataPolicy const&, JSStructuredCloneCallbacks const*, void*) /js/src/vm/StructuredClone.cpp:3438:10
    #10 0x7f0d31173eb8 in mozilla::dom::StructuredCloneHolder::ReadFromBuffer(nsIGlobalObject*, JSContext*, JSStructuredCloneData&, unsigned int, JS::MutableHandle<JS::Value>, JS::CloneDataPolicy const&, mozilla::ErrorResult&) /dom/base/StructuredCloneHolder.cpp:409:8
    #11 0x7f0d31173dd4 in mozilla::dom::StructuredCloneHolder::ReadFromBuffer(nsIGlobalObject*, JSContext*, JSStructuredCloneData&, JS::MutableHandle<JS::Value>, JS::CloneDataPolicy const&, mozilla::ErrorResult&) /dom/base/StructuredCloneHolder.cpp:395:3
    #12 0x7f0d35583f97 in mozilla::dom::ipc::StructuredCloneData::Read(JSContext*, JS::MutableHandle<JS::Value>, JS::CloneDataPolicy const&, mozilla::ErrorResult&) /dom/ipc/StructuredCloneData.cpp:116:3
    #13 0x7f0d3557be0c in mozilla::dom::ipc::StructuredCloneData::Read(JSContext*, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /dom/ipc/StructuredCloneData.cpp:104:3
    #14 0x7f0d2c60fc70 in FuzzingRunDomSC(unsigned char const*, unsigned long) /dom/base/fuzztest/FuzzStructuredClone.cpp:62:10
    [...]

To reproduce the issue, perform the following steps:

1. Download the attached testcase, save as "test.bin".
   2a. Build with --enable-fuzzing (requires Clang and ASan, also build gtests using ./mach gtest dontruntests).
   2b. Alternatively you can download builds from TC using python -mfuzzfetch -a --fuzzing --target firefox gtest (see https://github.com/MozillaSecurity/fuzzfetch).
2. Run FUZZER=StructuredCloneReaderDOM objdir/dist/bin/firefox test.bin

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Andrew McCreight [:mccr8]]

It looks like we're hitting a null deref inside of CheckedInt. I'm not sure what that means, though, as there is no line number on the top frame.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Oh, hmm, https://searchfox.org/mozilla-central/rev/dc09246dfbfd8dafeb6d55ebee18a6294d525443/js/src/vm/StructuredClone.cpp#3616
As far as I see, readString may return null, so JS_ReadString returns a success value even though the underlying call fails, right?

Comment 5

[Kagami Rosylight [:saschanaz] (they/them)]

I'm not sure what I can do with testcase.bin, was this supposed to a zip file? 🤔

Edit: Ah okay, comment #0 has the steps. 😛

Comment 6

[Christian Holler (:decoder)]

(In reply to Kagami :saschanaz from comment #5)

I'm not sure what I can do with testcase.bin, was this supposed to a zip file? 🤔

Edit: Ah okay, comment #0 has the steps. 😛

Yea, the .bin file is the input to the fuzzing target, which in this case is here:

https://searchfox.org/mozilla-central/rev/2e328e8040a4b4419647aabdc536a3f61bafc384/dom/base/fuzztest/FuzzStructuredClone.cpp#35

So this is the data that ends up in StructuredCloneData.

Comment 7

[Kagami Rosylight [:saschanaz] (they/them)]

Thanks, it totally makes sense to be a binary then!

BTW, do any of you know how to make a testcase here? Probably no way to cause such wrong binary by a WPT or a mochitest 🤔

Comment 8

[Kagami Rosylight [:saschanaz] (they/them)]

Attachment: Bug 1766647 - Check readString result in JS_ReadString r=sfink

Comment 9

[Christian Holler (:decoder)]

(In reply to Kagami :saschanaz from comment #7)

Thanks, it totally makes sense to be a binary then!

BTW, do any of you know how to make a testcase here? Probably no way to cause such wrong binary by a WPT or a mochitest 🤔

Unfortunately, we don't have a good test framework for this right now, except crafting a gtest. But I am not sure if that would really provide us with a lot of benefits because fuzzing is exercising the code already by the exact same means (the fuzzing target is practically acting like a dynamic gtest).

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8f546f819299
Check readString result in JS_ReadString r=sfink

Comment 11

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/8f546f819299