1776359 - null-deref in mozilla::ipc::ActorLifecycleProxy::GetWeakProxy (via oss-fuzz's ContentParentIPC)

Status: RESOLVED WONTFIX

(Core :: IPC, defect)

Description

[teemperor]

Attachment: firefox_ipc_crash

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36

Steps to reproduce:

I ran the firefox fuzzers in oss-fuzz in a different build mode (compiled with -O0) and ran into a nullptr deref.

How to reproduce:

1. get oss-fuzz
2. patch the build script to use -O0

diff --git a/projects/firefox/build.sh b/projects/firefox/build.sh
index 71f7f6b..6e7c356 100755
--- a/projects/firefox/build.sh
+++ b/projects/firefox/build.sh
@@ -1,2 +1,4 @@
 #!/bin/bash -eu
+export CFLAGS="$CFLAGS -O0 -fno-builtin -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION"
+export CXXFLAGS="$CXXFLAGS -O0 -fno-builtin -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION"
 # Copyright 2019 Google Inc.

3. build oss-fuzz firefox as usual.
4. Run ContentParentIPC firefox_ipc_crash (that file is attached).

If your system like mine can't runt he binary directly due to libc incompatibility, you can also create a folder called inputs in oss-fuzz/build/out/firefox/ and then run:

python ~/oss-fuzz/infra/helper.py run_fuzzer firefox ImageGIF /out/inputs "\-runs=100"

Also I put the security label because I don't know how relevant this is. Feel free to remove.

Actual results:

INFO:root:Running: docker run --rm --privileged -i -e FUZZING_ENGINE=libfuzzer -e SANITIZER=address -e RUN_FUZZER_MODE=interactive -v /home/fuzzer/oss-fuzz/build/out/firefox:/out -t gcr.io/oss-fuzz-base/base-runner run_fuzzer ./ContentParentIPC /out/fuck '\-runs=1'.
/out/./ContentParentIPC -rss_limit_mb=2560 -timeout=25 /out/fuck \-runs=1 /tmp/./ContentParentIPC_corpus -close_fd_mask=2 < /dev/null
*** You are running in headless mode.
Running Fuzzer tests...
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 3579385886
INFO: Loaded 1 modules   (3529562 inline 8-bit counters): 3529562 [0x7fcc604dc230, 0x7fcc60839d8a), 
INFO: Loaded 1 PC tables (3529562 PCs): 3529562 [0x7fcc60839d90,0x7fcc63e15330), 
INFO:        1 files found in /out/fuck
INFO:        0 files found in /tmp/./ContentParentIPC_corpus
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
INFO: seed corpus: files: 1 min: 44b max: 44b total: 44b rss: 449Mb
=================================================================
==16==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x7fcc458a78a2 bp 0x7fff5d955d70 sp 0x7fff5d955d40 T0)
==16==The signal is caused by a READ memory access.
==16==Hint: address points to the zero page.
SCARINESS: 10 (null-deref)
    #0 0x7fcc458a78a2 in operator! /work/obj-fuzz/dist/include/mozilla/RefPtr.h:311:36
    #1 0x7fcc458a78a2 in mozilla::ipc::ActorLifecycleProxy::GetWeakProxy() /src/mozilla-central/ipc/glue/ProtocolUtils.cpp:232:7
    #2 0x7fcc458afa6c in mozilla::ipc::IPDLResolverInner::IPDLResolverInner(mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message> >, mozilla::ipc::IProtocol*) /src/mozilla-central/ipc/glue/ProtocolUtils.cpp:779:47
    #3 0x7fcc4d6a96f2 in mozilla::dom::PContentParent::OnMessageReceived(IPC::Message const&) /work/obj-fuzz/ipc/ipdl/PContentParent.cpp:15196:21
    #4 0x7fcc421528a2 in void mozilla::ipc::FuzzProtocol<mozilla::dom::ContentParent>(mozilla::dom::ContentParent*, unsigned char const*, unsigned long, nsTArray<nsTString<char> > const&) /work/obj-fuzz/dist/include/ProtocolFuzzer.h:99:18
    #5 0x7fcc42151d08 in RunContentParentIPCFuzzing(unsigned char const*, unsigned long) /src/mozilla-central/dom/ipc/fuzztest/content_parent_ipc_libfuzz.cpp:27:3
    #6 0x55c7d0e675ce in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/firefox/firefox+0x3315ce) (BuildId: e6a3a269f6db1e136c904040822c3c6e981e7464)
    #7 0x55c7d0e668ff in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool, bool*) (/out/firefox/firefox+0x3308ff) (BuildId: e6a3a269f6db1e136c904040822c3c6e981e7464)
    #8 0x55c7d0e68384 in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::vector<fuzzer::SizedFile, std::allocator<fuzzer::SizedFile> >&) (/out/firefox/firefox+0x332384) (BuildId: e6a3a269f6db1e136c904040822c3c6e981e7464)
    #9 0x55c7d0e685a7 in fuzzer::Fuzzer::Loop(std::vector<fuzzer::SizedFile, std::allocator<fuzzer::SizedFile> >&) (/out/firefox/firefox+0x3325a7) (BuildId: e6a3a269f6db1e136c904040822c3c6e981e7464)
    #10 0x55c7d0e58ae0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/firefox/firefox+0x322ae0) (BuildId: e6a3a269f6db1e136c904040822c3c6e981e7464)
    #11 0x7fcc536f19e7 in mozilla::FuzzerRunner::Run(int*, char***) /src/mozilla-central/tools/fuzzing/interface/harness/FuzzerRunner.cpp:75:13
    #12 0x7fcc53610d96 in XREMain::XRE_mainStartup(bool*) /src/mozilla-central/toolkit/xre/nsAppRunner.cpp:4763:35
    #13 0x7fcc53622bda in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/mozilla-central/toolkit/xre/nsAppRunner.cpp:5930:12
    #14 0x7fcc53623d00 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/mozilla-central/toolkit/xre/nsAppRunner.cpp:6006:21
    #15 0x7fcc5363ff80 in mozilla::BootstrapImpl::XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/mozilla-central/toolkit/xre/Bootstrap.cpp:45:12
    #16 0x55c7d0cb2539 in main (/out/firefox/firefox+0x17c539) (BuildId: e6a3a269f6db1e136c904040822c3c6e981e7464)
    #17 0x7fcc690e3082 in __libc_start_main (/out/./lib/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee)
    #18 0x55c7d0bf20c8 in _start (/out/firefox/firefox+0xbc0c8) (BuildId: e6a3a269f6db1e136c904040822c3c6e981e7464)

DEDUP_TOKEN: operator!--mozilla::ipc::ActorLifecycleProxy::GetWeakProxy()--mozilla::ipc::IPDLResolverInner::IPDLResolverInner(mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message> >, mozilla::ipc::IProtocol*)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /work/obj-fuzz/dist/include/mozilla/RefPtr.h:311:36 in operator!
==16==ABORTING
MS: 0 ; base unit: 0000000000000000000000000000000000000000
0x4,0x0,0x0,0x0,0xff,0xff,0xff,0x7f,0x65,0x1,0x3b,0x0,0x0,0x0,0x0,0x4,0x5,0xff,0x0,0xff,0x0,0x0,0x0,0x11,0x4,0x5,0xff,0x0,0xff,0xff,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0xc6,0x0,0x0,0x6d,0x0,0x0,
\004\000\000\000\377\377\377\177e\001;\000\000\000\000\004\005\377\000\377\000\000\000\021\004\005\377\000\377\377\000\000\000\000\000\000\000\000\306\000\000m\000\000
artifact_prefix='./'; Test unit written to ./crash-31528699b0bd24d0d918cebdae6d239920aabc6f
Base64: BAAAAP///39lATsAAAAABAX/AP8AAAARBAX/AP//AAAAAAAAAADGAABtAAA=

Expected results:

Not crash.

Comment 1

[Andrew McCreight [:mccr8]]

Thanks for the report. I'm not sure what is going wrong here (the line numbers for PContentParent::OnMessageReceived don't match up to what I'm seeing on mozilla-central, and I see null checks in the obvious place), but I think this doesn't need to be hidden because it is a null deref.

Comment 2

[Nika Layzell [:nika] (ni? for response)]

IIRC the ContentParentIPC fuzzer is somewhat busted right now, and we're not actively using it. ni? :decoder to see if that impression is correct.

Comment 3

[Christian Holler (:decoder)]

Yes. ContentParentIPC is not supported anymore as a fuzz target because it had lots of false positives.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jld, could you have a look please?

For more information, please visit auto_nag documentation.