1850065 - AddressSanitizer: heap-buffer-overflow [@ __asan_memcpy] with READ of size 8

Status: RESOLVED DUPLICATE of bug 1846685

(Core :: Graphics, defect)

Description

[Jesse Schwartzentruber (:truber)]

The attached testcase crashes on mozilla-central revision 20230824-014c9a0ccc44 (build with --enable-fuzzing & moz2d target patch).

For detailed crash information, see attachment.

To reproduce the issue:

1. Build an ASan --enable-fuzzing build including gtests with https://phabricator.services.mozilla.com/D186833 applied.
2. Run FUZZER=Moz2D objdir/dist/bin/firefox test.bin

Comment 1

[Jesse Schwartzentruber (:truber)]

Attachment: Detailed Crash Information

Comment 2

[Jesse Schwartzentruber (:truber)]

Attachment: Testcase

Comment 3

[Jesse Schwartzentruber (:truber)]

Attachment: crash.cpp

Decoded test.bin call.

Comment 4

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/nrXSAewrepw0tfgz7uMvog/index.html

Comment 5

[Tyson Smith [:tsmith]]

This issue is triggered within seconds of launching the fuzzer. Marking as fuzzblocker.

Comment 6

[Bob Owen (:bobowen)]

Is this fixed by the patch in bug 1846685?

Comment 7

[Jesse Schwartzentruber (:truber)]

(In reply to Bob Owen (:bobowen) from comment #6)

Is this fixed by the patch in bug 1846685?

No, I get the same stack with D186161 applied.

Comment 8

[Jesse Schwartzentruber (:truber)]

My mistake, I had not rebuilt gtest to pick up the patch.

It does appear to fix the testcases here and in bug 1850064. In both cases I see the following, but no crash:

[GFX1-]: Replay failure: PathCreation PLAY
[GFX1-]: Replay failure: PathCreation PLAY

Comment 9

[Bob Owen (:bobowen)]

(In reply to Jesse Schwartzentruber (:truber) from comment #8)

My mistake, I had not rebuilt gtest to pick up the patch.

It does appear to fix the testcases here and in bug 1850064. In both cases I see the following, but no crash:

[GFX1-]: Replay failure: PathCreation PLAY
[GFX1-]: Replay failure: PathCreation PLAY

Ah, great I was scratching my head as to what might be going wrong.
I'm not too familiar with this use of the Moz2D recording, but that error seems about right as we just return false as a failure of the CheckedStreamToSink.