Closed Bug 1871216 Opened 2 years ago Closed 2 years ago

Crash in [@ strlen | nsCharTraits<T>::length]

Categories

(Core :: IPC, defect, P1)

Product:
Core
Component:
IPC
Version:
Firefox 120
Platform:
Unspecified
Windows 10
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1862723

People

(Reporter: pbone, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, csectype-uaf)

Crash Data

Crash report: https://crash-stats.mozilla.org/report/index/0c94259c-f661-4fd6-94b1-95a0f0231205

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  ucrtbase.dll  strlen  
1  xul.dll  nsCharTraits<char>::length  xpcom/string/nsCharTraits.h:423
1  xul.dll  nsTDependentString<char>::nsTDependentString  xpcom/string/nsTDependentString.h:76
1  xul.dll  mozilla::dom::ContentParent::KillHard  dom/ipc/ContentParent.cpp:4536
2  xul.dll   const  ipc/glue/BackgroundImpl.cpp:781
2  xul.dll  mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/ipc/glue/BackgroundImpl.cpp:781:3'>::Run  xpcom/threads/nsThreadUtils.h:549
3  xul.dll  mozilla::RunnableTask::Run  xpcom/threads/TaskController.cpp:549
3  xul.dll  mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal  xpcom/threads/TaskController.cpp:876
4  xul.dll  mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal  xpcom/threads/TaskController.cpp:699
4  xul.dll  mozilla::TaskController::ProcessPendingMTTask  xpcom/threads/TaskController.cpp:485

This is a PHC crash with the following extra information.

Free stack:

#0 fu2::abi_400::detail::type_erasure::tables::vtable<fu2::abi_400::detail::property<0,0,void ()> >::trait<fu2::abi_400::detail::type_erasure::box<0,lambda at /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:141:27',std::allocator<lambda at /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:141:27'> > >::construct<fu2::abi_400::detail::type_erasure::box<0,lambda at /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:141:27',std::allocator<lambda at /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:141:27'> > >(std::integral_constant<bool,1>, fu2::abi_400::detail::type_erasure::box<0,lambda at /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:141:27',std::allocator<lambda at /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:141:27'> >&&, fu2::abi_400::detail::type_erasure::tables::vtable<fu2::abi_400::detail::property<0,0,void ()> >, fu2::abi_400::detail::type_erasure::data_accessor, unsigned long long)
in file /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/utility line 602
#1 IPC::ParamTraits<mozilla::dom::PServiceWorkerRegistrationChild >::Write(IPC::MessageWriter, mozilla::dom::PServiceWorkerRegistrationChild* const&)
#2 mozilla::dom::(anonymous namespace)::CreateStorageConnection(nsIFile&, nsIFile&, nsTSubstring<char> const&)
#3 mozilla::ipc::PBackgroundParent::RemoveManagee(int, mozilla::ipc::IProtocol*)
#4 mozilla::ipc::NodeController::~NodeController()
in file hg:hg.mozilla.org/releases/mozilla-release:xpcom/ds/nsTHashtable.h:d80eefe94738ab6bd35cca64747d877c49337318 line 279
#5 mozilla::dom::Element::SetAttr(int, nsAtom*, nsAtom*, nsTSubstring<char16_t> const&, nsIPrincipal*, bool)
in file s3:gecko-generated-sources:f98bb84768c8fdab5bb64b750fdf1f4c5e6f5d54ca9688c4729d53697f4aefa6838410bb79d6b99221b864db91eac8581e966c9e46f8ec1344628613075347cd/dom/base/GeneratedElementDocumentState.h: line 39
#6 js::frontend::FunctionScriptEmitter::emitEndBody()
in file hg:hg.mozilla.org/releases/mozilla-release:js/src/frontend/BytecodeSection.cpp:d80eefe94738ab6bd35cca64747d877c49337318 line 182
#7 js::jit::MacroAssembler::unguardedCallPreBarrier<js::jit::Address>(js::jit::Address const&, js::jit::MIRType)
in file hg:hg.mozilla.org/releases/mozilla-release:js/src/jit/x86-shared/BaseAssembler-x86-shared.h:d80eefe94738ab6bd35cca64747d877c49337318 line 6338
#8 MessageLoop::MessageLoop(MessageLoop::Type, nsISerialEventTarget*)
in file /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/xmemory line 1008
#9 nsTimerImpl::CancelImpl(bool)
in file /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/functional line 947
#10 allocateBtreePage(BtShared*, MemPage**, unsigned int*, unsigned int, unsigned char)
in file hg:hg.mozilla.org/mozilla-central:third_party/sqlite3/src/sqlite3.c:785b3d438fe5a8cba4caf5f4a2ed7250d324096c line 75988
#11 winRandomness(sqlite3_vfs*, int, char*)
in file hg:hg.mozilla.org/mozilla-central:third_party/sqlite3/src/sqlite3.c:785b3d438fe5a8cba4caf5f4a2ed7250d324096c line 51693
#12 unsigned long __crt_strtox::parse_integer<unsigned long,class __crt_strtox::c_string_character_source<char>,1>(class __crt_cached_ptd_host &,class __crt_strtox::c_string_character_source<char>,int,bool)
#13 BaseThreadInitThunk (kernel32 +0x17344)
#14 DllBlocklist_Initialize(unsigned int)
in file hg:hg.mozilla.org/mozilla-central:toolkit/xre/dllservices/mozglue/ModuleLoadFrame.cpp:e901b86e5d894b8b40093d72036208cf8837e098 line 33
#15 EtwpReceiveReplyDataBlock

Alloc stack:

#0 NS_ProcessNextEvent(nsIThread*, bool)
#1 MozJemallocPHC::malloc(unsigned long long)
in file hg:hg.mozilla.org/mozilla-central:memory/build/mozjemalloc.cpp:e901b86e5d894b8b40093d72036208cf8837e098 line 1897
#2 NS_ProcessNextEvent(nsIThread*, bool)
#3 fu2::abi_400::detail::type_erasure::tables::vtable<fu2::abi_400::detail::property<0,0,void ()> >::trait<fu2::abi_400::detail::type_erasure::box<0,lambda at /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:141:27',std::allocator<lambda at /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:141:27'> > >::construct<fu2::abi_400::detail::type_erasure::box<0,lambda at /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:141:27',std::allocator<lambda at /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:141:27'> > >(std::integral_constant<bool,1>, fu2::abi_400::detail::type_erasure::box<0,lambda at /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:141:27',std::allocator<lambda at /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:141:27'> >&&, fu2::abi_400::detail::type_erasure::tables::vtable<fu2::abi_400::detail::property<0,0,void ()> >, fu2::abi_400::detail::type_erasure::data_accessor, unsigned long long)
in file hg:hg.mozilla.org/releases/mozilla-release:third_party/function2/include/function2/function2.hpp:d80eefe94738ab6bd35cca64747d877c49337318 line 948
#4 IPC::ParamTraits<mozilla::dom::PServiceWorkerRegistrationChild >::Write(IPC::MessageWriter, mozilla::dom::PServiceWorkerRegistrationChild* const&)
#5 mozilla::dom::(anonymous namespace)::CreateStorageConnection(nsIFile&, nsIFile&, nsTSubstring<char> const&)
#6 mozilla::ipc::PBackgroundParent::RemoveManagee(int, mozilla::ipc::IProtocol*)
#7 mozilla::ipc::NodeController::~NodeController()
in file hg:hg.mozilla.org/releases/mozilla-release:xpcom/ds/nsTHashtable.h:d80eefe94738ab6bd35cca64747d877c49337318 line 279
#8 mozilla::dom::Element::SetAttr(int, nsAtom*, nsAtom*, nsTSubstring<char16_t> const&, nsIPrincipal*, bool)
in file s3:gecko-generated-sources:f98bb84768c8fdab5bb64b750fdf1f4c5e6f5d54ca9688c4729d53697f4aefa6838410bb79d6b99221b864db91eac8581e966c9e46f8ec1344628613075347cd/dom/base/GeneratedElementDocumentState.h: line 39
#9 js::frontend::FunctionScriptEmitter::emitEndBody()
in file hg:hg.mozilla.org/releases/mozilla-release:js/src/frontend/BytecodeSection.cpp:d80eefe94738ab6bd35cca64747d877c49337318 line 182
#10 js::jit::MacroAssembler::unguardedCallPreBarrier<js::jit::Address>(js::jit::Address const&, js::jit::MIRType)
in file hg:hg.mozilla.org/releases/mozilla-release:js/src/jit/x86-shared/BaseAssembler-x86-shared.h:d80eefe94738ab6bd35cca64747d877c49337318 line 6338
#11 MessageLoop::MessageLoop(MessageLoop::Type, nsISerialEventTarget*)
in file /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/xmemory line 1008
#12 nsTimerImpl::CancelImpl(bool)
in file /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/functional line 947
#13 allocateBtreePage(BtShared*, MemPage**, unsigned int*, unsigned int, unsigned char)
in file hg:hg.mozilla.org/mozilla-central:third_party/sqlite3/src/sqlite3.c:785b3d438fe5a8cba4caf5f4a2ed7250d324096c line 75988
#14 winRandomness(sqlite3_vfs*, int, char*)
in file hg:hg.mozilla.org/mozilla-central:third_party/sqlite3/src/sqlite3.c:785b3d438fe5a8cba4caf5f4a2ed7250d324096c line 51693
#15 unsigned long __crt_strtox::parse_integer<unsigned long,class __crt_strtox::c_string_character_source<char>,1>(class __crt_cached_ptd_host &,class __crt_strtox::c_string_character_source<char>,int,bool)

Group: core-security → dom-core-security

gsvelto already mentioned this crash in bug 1862723, which we've patched as it also showed up on TreeHerder.

Status: NEW → RESOLVED
Closed: 2 years ago
Duplicate of bug: 1862723
Resolution: --- → DUPLICATE
Group: dom-core-security → core-security-release

Thanks, I thought I'd seen discussion about it if not a fix, but I couldn't find it.

Group: core-security-release
You need to log in before you can comment on or make changes to this bug.