1799748 - (CVE-2022-44638) Evaluate libpixman CVE-2022-44638 fix

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Ryan VanderMeulen [:RyanVM]]

libpixman 0.42.2 was recently announced with a fix for CVE-2022-44638.
https://lists.freedesktop.org/archives/pixman/2022-November/004994.html

The actual fix looks pretty simple if it's something that impacts Firefox.
https://gitlab.freedesktop.org/pixman/pixman/-/commit/a1f88e842e0216a5b4df1ab023caebe33c101395

I'll put up a patch for that to get the ball rolling.

Comment 1

[Ryan VanderMeulen [:RyanVM]]

Attachment: Bug 1799748 - Backport fix for libpixman CVE-2022-44638. r=jfkthame

Backport of upstream commit:
https://gitlab.freedesktop.org/pixman/pixman/-/commit/a1f88e842e0216a5b4df1ab023caebe33c101395

Comment 2

[Ryan VanderMeulen [:RyanVM]]

Try push:
https://treeherder.mozilla.org/jobs?repo=try&revision=3df405a1ad765359fa737f51ca21f747f207d630

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/bac7456de5c6
Backport fix for libpixman CVE-2022-44638. r=jfkthame

Comment 4

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/bac7456de5c6

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:RyanVM, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox107 to wontfix.

For more information, please visit auto_nag documentation.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

AFAWCT, this isn't critical enough to warrant a late uplift this cycle. We'll uplift it to ESR next cycle just for completeness' sake, however.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9302587 [details]
Bug 1799748 - Backport fix for libpixman CVE-2022-44638. r=jfkthame

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: Backport of an upstream security fix
• User impact if declined: Not entirely clear how reachable this code actually is in Gecko, but the risk of the patch is basically zero so better safe than sorry
• Fix Landed on Version: 108
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky):

Comment 8

[Dianna Smith [:diannaS]]

Comment on attachment 9302587 [details]
Bug 1799748 - Backport fix for libpixman CVE-2022-44638. r=jfkthame

Approved for 102.6esr

Comment 9

[Dianna Smith [:diannaS]]

https://hg.mozilla.org/releases/mozilla-esr102/rev/47feff550f43