1847788 - Crash [@ nsIURI::SchemeIs] through [@ mozilla::dom::WindowGlobalParent::RecvReloadWithHttpsOnlyException]

Status: RESOLVED FIXED

(Core :: DOM: Content Processes, defect, P2)

Description

[Christian Holler (:decoder)]

In experimental IPC fuzzing, we found the following crash on mozilla-central revision f14ed3bab724+ (fuzzing-asan-nyx-opt build):

=================================================================
==1733==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fffca03b524 bp 0x7ffffffe3b50 sp 0x7ffffffe3a20 T0)
==1733==The signal is caused by a READ memory access.
==1733==Hint: address points to the zero page.
    #0 0x7fffca03b524 in nsIURI::SchemeIs(char const*) objdir-ff-aflpp/dist/include/nsIURI.h:98:39
    #1 0x7fffd9dcb325 in mozilla::dom::WindowGlobalParent::RecvReloadWithHttpsOnlyException() dom/ipc/WindowGlobalParent.cpp:1292:35
    #2 0x7fffda345366 in mozilla::dom::PWindowGlobalParent::OnMessageReceived(IPC::Message const&) objdir-ff-aflpp/ipc/ipdl/PWindowGlobalParent.cpp:1959:86
    #3 0x7fffda062260 in mozilla::dom::PContentParent::OnMessageReceived(IPC::Message const&) objdir-ff-aflpp/ipc/ipdl/PContentParent.cpp:6681:32
    #4 0x7fffccc0b586 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) ipc/glue/MessageChannel.cpp:1826:25
    #5 0x7fffccc07155 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message> >) ipc/glue/MessageChannel.cpp:1747:9
    [...]

This is a simple null check missing, BrowsingContext()->Top()->GetCurrentURI() is returning null here. Patch coming up soon.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Christian Holler (:decoder)]

Attachment: Bug 1847788 - Add missing null check to RecvReloadWithHttpsOnlyException. r?nika

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/60bddb7ad6aa
Add missing null check to RecvReloadWithHttpsOnlyException. r=nika

Comment 5

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/60bddb7ad6aa

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Looks like we see these crashes in the wild too - did you want to nominate this for Beta & ESR115 approval?

Comment 7

[Andrew McCreight [:mccr8]]

FWIW, I don't see any crashes with this signature that have RecvReloadWithHttpsOnlyException in the proto signature, so I don't think this patch will help any of our existing issues. Crashes under this signature look like they come from a wide variety of call sites.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Alright, thanks for the clarification.