1833580 - Crash when using dev tools eyedropper with RFP randomization [@ memcpy | SHA256_Update_Generic]

Status: RESOLVED DUPLICATE of bug 1833213

(Core :: Privacy: Anti-Tracking, defect)

Description

[Kestrel]

STR:

1. Start with the following settings on Ubuntu 23.04:
   privacy.resistFingerprinting = true
privacy.resistFingerprinting.randomization.enabled = true
2. Visit https://www.mozilla.org.
3. Open the developer tools (Ctrl+Shift+I).
4. Select the eyedropper tool and move it around the page for some time or click to sample a color.

Crash report: https://crash-stats.mozilla.org/report/index/e0f49a0b-ab65-4980-bad7-664fe0230517

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0  libfreeblpriv3.so  memcpy  /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/include/x86_64-linux-gnu/bits/string3.h:51
0  libfreeblpriv3.so  SHA256_Update_Generic  security/nss/lib/freebl/sha512.c:547
1  libsoftokn3.so  sftk_MAC_Update  security/nss/lib/softoken/sftkhmac.c:373
2  libsoftokn3.so  sftk_MACUpdate  security/nss/lib/softoken/pkcs11c.c:3194
3  libnss3.so  PK11_DigestOp  security/nss/lib/pk11wrap/pk11cxt.c
4  libxul.so  mozilla::DigestBase::Update  security/manager/ssl/ScopedNSSTypes.h:118
5  libxul.so  mozilla::nsRFPService::GenerateCanvasKeyFromImageData  toolkit/components/resistfingerprinting/nsRFPService.cpp:1361
6  libxul.so  mozilla::nsRFPService::RandomizePixels  toolkit/components/resistfingerprinting/nsRFPService.cpp:1385
7  libxul.so  mozilla::dom::CanvasRenderingContext2D::GetImageDataArray  dom/canvas/CanvasRenderingContext2D.cpp:5875
8  libxul.so  mozilla::dom::CanvasRenderingContext2D::GetImageData  dom/canvas/CanvasRenderingContext2D.cpp:5764

Comment 1

[Tim Huang[:timhuang]]

I can confirm that the crash no longer happens after Bug 1833213 lands. In Bug 1833213, we have fixed how we access the image buffer when calling CanvasRenderingContext2D::GetImageDataArray(), which is the root cause of this crash.