1923706 - AddressSanitizer: stack-use-after-return [@ Write] with READ of size 8

Reporter

Description

•

7 months ago

Found while fuzzing mozilla-central rev 94994d98cc74 (built with: --enable-address-sanitizer --enable-fuzzing).

I don't currently have a reproducible testcase.

AddressSanitizer: stack-use-after-return [@ Write] with READ of size 8

    =================================================================
    ==26191==ERROR: AddressSanitizer: stack-use-after-return on address 0x72af06287520 at pc 0x72af38145971 bp 0x72af05dff210 sp 0x72af05dff208
    READ of size 8 at 0x72af06287520 thread T29
        #0 0x72af38145970 in Write /gecko/ipc/chromium/src/chrome/common/ipc_message_utils.h:885:45
        #1 0x72af38145970 in WriteParam<const unsigned long &> /gecko/ipc/chromium/src/chrome/common/ipc_message_utils.h:455:3
        #2 0x72af38145970 in mozilla::camera::PCamerasChild::SendAllocateCapture(mozilla::camera::CaptureEngine const&, nsTSubstring<char> const&, unsigned long const&) /builds/worker/workspace/obj-build/ipc/ipdl/PCamerasChild.cpp:241:5
        #3 0x72af380efdb2 in operator()<StoreCopyPassByConstLRef<mozilla::camera::CaptureEngine> &, StoreCopyPassByConstLRef<nsTString<char> > &, StoreConstRefPassByConstLRef<unsigned long> &> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1085:18
        #4 0x72af380efdb2 in __invoke_impl<bool, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), StoreCopyPassByConstLRef<mozilla::camera::CaptureEngine> &, StoreCopyPassByConstLRef<nsTString<char> > &, StoreConstRefPassByConstLRef<unsigned long> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
        #5 0x72af380efdb2 in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), StoreCopyPassByConstLRef<mozilla::camera::CaptureEngine> &, StoreCopyPassByConstLRef<nsTString<char> > &, StoreConstRefPassByConstLRef<unsigned long> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
        #6 0x72af380efdb2 in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<StoreCopyPassByConstLRef<mozilla::camera::CaptureEngine>, StoreCopyPassByConstLRef<nsTString<char> >, StoreConstRefPassByConstLRef<unsigned long> > &, 0UL, 1UL, 2UL> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
        #7 0x72af380efdb2 in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<StoreCopyPassByConstLRef<mozilla::camera::CaptureEngine>, StoreCopyPassByConstLRef<nsTString<char> >, StoreConstRefPassByConstLRef<unsigned long> > &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
        #8 0x72af380efdb2 in apply<mozilla::camera::CamerasChild, bool (mozilla::camera::PCamerasChild::*)(const mozilla::camera::CaptureEngine &, const nsTSubstring<char> &, const unsigned long &)> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:12
        #9 0x72af380efdb2 in mozilla::detail::RunnableMethodImpl<mozilla::camera::CamerasChild*, bool (mozilla::camera::PCamerasChild::*)(mozilla::camera::CaptureEngine const&, nsTSubstring<char> const&, unsigned long const&), true, (mozilla::RunnableKind)0, mozilla::camera::CaptureEngine, nsTString<char>, unsigned long const&>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1134:13
        #10 0x72af303d5966 in nsThread::ProcessNextEvent(bool, bool*) /gecko/xpcom/threads/nsThread.cpp:1149:16
        #11 0x72af303e0318 in NS_ProcessNextEvent(nsIThread*, bool) /gecko/xpcom/threads/nsThreadUtils.cpp:480:10
        #12 0x72af3196b483 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /gecko/ipc/glue/MessagePump.cpp:299:20
        #13 0x72af3184f0e4 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:370:10
        #14 0x72af3184f0e4 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:363:3
        #15 0x72af3184f0e4 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:345:3
        #16 0x72af303ce4dc in nsThread::ThreadFunc(void*) /gecko/xpcom/threads/nsThread.cpp:366:10
        #17 0x72af50c0761b in _pt_root /gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
        #18 0x62434175c368 in asan_thread_start(void*) /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:239:28
        #19 0x72af50df9ac2 in start_thread nptl/pthread_create.c:442:8
        #20 0x72af50e8b84f  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
    
    Address 0x72af06287520 is located in stack of thread T28 at offset 32 in frame
        #0 0x72af380c7d8f in mozilla::camera::CamerasChild::AllocateCapture(mozilla::camera::CaptureEngine, char const*, unsigned long) /gecko/dom/media/systemservices/CamerasChild.cpp:333
    
      This frame has 3 object(s):
        [32, 40) 'aWindowID.addr' <== Memory access at offset 32 is inside this variable
        [64, 80) 'unique_id' (line 335)
        [96, 152) 'dispatcher' (line 340)
    HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
          (longjmp and C++ exceptions *are* supported)
    Thread T28 created by T0 (Isolated Web Co) here:
        #0 0x624341745d71 in pthread_create /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:250:3
        #1 0x72af50bf7fd8 in _PR_CreateThread /gecko/nsprpub/pr/src/pthreads/ptthread.c:458:14
        #2 0x72af50be614e in PR_CreateThread /gecko/nsprpub/pr/src/pthreads/ptthread.c:533:12
        #3 0x72af303d1049 in nsThread::Init(nsTSubstring<char> const&) /gecko/xpcom/threads/nsThread.cpp:615:20
        #4 0x72af303deb76 in nsThreadManager::NewNamedThread(nsTSubstring<char> const&, nsIThreadManager::ThreadCreationOptions, nsIThread**) /gecko/xpcom/threads/nsThreadManager.cpp:606:22
        #5 0x72af303e97b9 in NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, already_AddRefed<nsIRunnable>, nsIThreadManager::ThreadCreationOptions) /gecko/xpcom/threads/nsThreadUtils.cpp:176:57
        #6 0x72af303e2841 in NS_NewNamedThread /gecko/xpcom/threads/nsThreadUtils.cpp:168:10
        #7 0x72af303e2841 in nsThreadPool::PutEvent(already_AddRefed<nsIRunnable>, unsigned int) /gecko/xpcom/threads/nsThreadPool.cpp:218:17
        #8 0x72af303e5681 in Dispatch /gecko/xpcom/threads/nsThreadPool.cpp:494:3
        #9 0x72af303e5681 in non-virtual thunk to nsThreadPool::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /gecko/xpcom/threads/nsThreadPool.cpp
        #10 0x72af3039bc00 in mozilla::TaskQueue::DispatchLocked(nsCOMPtr<nsIRunnable>&, unsigned int, mozilla::AbstractThread::DispatchReason) /gecko/xpcom/threads/TaskQueue.cpp:121:26
        #11 0x72af3039046e in mozilla::TaskQueue::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/obj-build/dist/include/mozilla/TaskQueue.h:73:14
        #12 0x72af3775c754 in InvokeAsync<(lambda at /dom/media/MediaManager.cpp:2239:37)> /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1854:12
        #13 0x72af3775c754 in operator() /gecko/dom/media/MediaManager.cpp:2238:16
        #14 0x72af3775c754 in InvokeMethod<(lambda at /dom/media/MediaManager.cpp:2197:7), RefPtr<mozilla::MozPromise<RefPtr<mozilla::media::Refcountable<nsTArray<RefPtr<mozilla::MediaDevice> > > >, RefPtr<mozilla::MediaMgrError>, true> > ((lambda at /dom/media/MediaManager.cpp:2197:7)::*)(mozilla::MozPromise<mozilla::camera::CamerasAccessStatus, mozilla::ipc::ResponseRejectReason, true>::ResolveOrRejectValue &&), mozilla::MozPromise<mozilla::camera::CamerasAccessStatus, mozilla::ipc::ResponseRejectReason, true>::ResolveOrRejectValue> /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:652:14
        #15 0x72af3775c754 in InvokeCallbackMethod<true, mozilla::MozPromise<RefPtr<mozilla::media::Refcountable<nsTArray<RefPtr<mozilla::MediaDevice> > > >, RefPtr<mozilla::MediaMgrError>, true>, (lambda at /dom/media/MediaManager.cpp:2197:7), RefPtr<mozilla::MozPromise<RefPtr<mozilla::media::Refcountable<nsTArray<RefPtr<mozilla::MediaDevice> > > >, RefPtr<mozilla::MediaMgrError>, true> > ((lambda at /dom/media/MediaManager.cpp:2197:7)::*)(mozilla::MozPromise<mozilla::camera::CamerasAccessStatus, mozilla::ipc::ResponseRejectReason, true>::ResolveOrRejectValue &&), mozilla::MozPromise<mozilla::camera::CamerasAccessStatus, mozilla::ipc::ResponseRejectReason, true>::ResolveOrRejectValue> /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:664:14
        #16 0x72af3775c754 in mozilla::MozPromise<mozilla::camera::CamerasAccessStatus, mozilla::ipc::ResponseRejectReason, true>::ThenValue<mozilla::MediaManager::MaybeRequestPermissionAndEnumerateRawDevices(mozilla::MediaManager::EnumerationParams)::$_0>::DoResolveOrRejectInternal(mozilla::MozPromise<mozilla::camera::CamerasAccessStatus, mozilla::ipc::ResponseRejectReason, true>::ResolveOrRejectValue&) /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:923:11
        #17 0x72af31a5c5e5 in mozilla::MozPromise<mozilla::camera::CamerasAccessStatus, mozilla::ipc::ResponseRejectReason, true>::ThenValueBase::ResolveOrRejectRunnable::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:488:21
        #18 0x72af3039ec2e in mozilla::SimpleTaskQueue::DrainTasks() /builds/worker/workspace/obj-build/dist/include/mozilla/TaskDispatcher.h:44:10
        #19 0x72af303d7d12 in nsThread::DrainDirectTasks() /gecko/xpcom/threads/nsThread.cpp:1353:16
        #20 0x72af303d5bca in nsThread::ProcessNextEvent(bool, bool*) /gecko/xpcom/threads/nsThread.cpp:1178:3
        #21 0x72af303e0318 in NS_ProcessNextEvent(nsIThread*, bool) /gecko/xpcom/threads/nsThreadUtils.cpp:480:10
        #22 0x72af31969bbe in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /gecko/ipc/glue/MessagePump.cpp:85:21
        #23 0x72af3184f0e4 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:370:10
        #24 0x72af3184f0e4 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:363:3
        #25 0x72af3184f0e4 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:345:3
        #26 0x72af3a66ff79 in nsBaseAppShell::Run() /gecko/widget/nsBaseAppShell.cpp:148:27
        #27 0x72af3a80901a in nsAppShell::Run() /gecko/widget/gtk/nsAppShell.cpp:469:33
        #28 0x72af3c4713ad in XRE_RunAppShell() /gecko/toolkit/xre/nsEmbedFunctions.cpp:710:20
        #29 0x72af3184f0e4 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:370:10
        #30 0x72af3184f0e4 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:363:3
        #31 0x72af3184f0e4 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:345:3
        #32 0x72af3c470995 in XRE_InitChildProcess(int, char**, XREChildData const*) /gecko/toolkit/xre/nsEmbedFunctions.cpp:645:34
        #33 0x62434179f7e9 in main /gecko/browser/app/nsBrowserApp.cpp:403:22
        #34 0x72af50d8ed8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    
    SUMMARY: AddressSanitizer: stack-use-after-return /gecko/ipc/chromium/src/chrome/common/ipc_message_utils.h:885:45 in Write
    Shadow bytes around the buggy address:
      0x72af06287280: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
      0x72af06287300: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
      0x72af06287380: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
      0x72af06287400: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
      0x72af06287480: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
    =>0x72af06287500: f5 f5 f5 f5[f5]f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
      0x72af06287580: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
      0x72af06287600: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
      0x72af06287680: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
      0x72af06287700: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
      0x72af06287780: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07 
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
    Thread T29 created by T28 here:
        #0 0x624341745d71 in pthread_create /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:250:3
        #1 0x72af50bf7fd8 in _PR_CreateThread /gecko/nsprpub/pr/src/pthreads/ptthread.c:458:14
        #2 0x72af50be614e in PR_CreateThread /gecko/nsprpub/pr/src/pthreads/ptthread.c:533:12
        #3 0x72af303d1049 in nsThread::Init(nsTSubstring<char> const&) /gecko/xpcom/threads/nsThread.cpp:615:20
        #4 0x72af303deb76 in nsThreadManager::NewNamedThread(nsTSubstring<char> const&, nsIThreadManager::ThreadCreationOptions, nsIThread**) /gecko/xpcom/threads/nsThreadManager.cpp:606:22
        #5 0x72af303e97b9 in NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, already_AddRefed<nsIRunnable>, nsIThreadManager::ThreadCreationOptions) /gecko/xpcom/threads/nsThreadUtils.cpp:176:57
        #6 0x72af380c445e in NS_NewNamedThread<12UL> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:87:10
        #7 0x72af380c445e in mozilla::camera::GetCamerasChild() /gecko/dom/media/systemservices/CamerasChild.cpp:74:19
        #8 0x72af383c7d04 in int mozilla::camera::GetChildAndCall<int (mozilla::camera::CamerasChild::*)(mozilla::MediaEventListener*, mozilla::AbstractThread*, mozilla::MediaEngineWebRTC*, void (mozilla::MediaEngineWebRTC::*)()), mozilla::MediaEventListener*, mozilla::AbstractThread*, mozilla::MediaEngineWebRTC*, void (mozilla::MediaEngineWebRTC::*)()>(int (mozilla::camera::CamerasChild::*&&)(mozilla::MediaEventListener*, mozilla::AbstractThread*, mozilla::MediaEngineWebRTC*, void (mozilla::MediaEngineWebRTC::*)()), mozilla::MediaEventListener*&&, mozilla::AbstractThread*&&, mozilla::MediaEngineWebRTC*&&, void (mozilla::MediaEngineWebRTC::*&&)()) /builds/worker/workspace/obj-build/dist/include/CamerasChild.h:130:25
        #9 0x72af383c78fd in mozilla::MediaEngineWebRTC::MediaEngineWebRTC() /gecko/dom/media/webrtc/MediaEngineWebRTC.cpp:45:3
        #10 0x72af3757d917 in mozilla::MediaManager::GetBackend() /gecko/dom/media/MediaManager.cpp:3525:20
        #11 0x72af3757b4e7 in mozilla::MediaManager::EnumerateRawDevices(mozilla::MediaManager::EnumerationParams) /gecko/dom/media/MediaManager.cpp:2263:28
        #12 0x72af3775d750 in operator() /gecko/dom/media/MediaManager.cpp:2241:19
        #13 0x72af3775d750 in mozilla::detail::ProxyFunctionRunnable<mozilla::MediaManager::MaybeRequestPermissionAndEnumerateRawDevices(mozilla::MediaManager::EnumerationParams)::$_0::operator()(mozilla::MozPromise<mozilla::camera::CamerasAccessStatus, mozilla::ipc::ResponseRejectReason, true>::ResolveOrRejectValue&&)::'lambda'(), mozilla::MozPromise<RefPtr<mozilla::media::Refcountable<nsTArray<RefPtr<mozilla::MediaDevice>>>>, RefPtr<mozilla::MediaMgrError>, true>>::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1816:29
        #14 0x72af3039d86f in mozilla::TaskQueue::Runner::Run() /gecko/xpcom/threads/TaskQueue.cpp:257:20
        #15 0x72af303e41fd in nsThreadPool::Run() /gecko/xpcom/threads/nsThreadPool.cpp:456:14
        #16 0x72af303d5966 in nsThread::ProcessNextEvent(bool, bool*) /gecko/xpcom/threads/nsThread.cpp:1149:16
        #17 0x72af303e0318 in NS_ProcessNextEvent(nsIThread*, bool) /gecko/xpcom/threads/nsThreadUtils.cpp:480:10
        #18 0x72af3196b221 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /gecko/ipc/glue/MessagePump.cpp:299:20
        #19 0x72af3184f0e4 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:370:10
        #20 0x72af3184f0e4 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:363:3
        #21 0x72af3184f0e4 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:345:3
        #22 0x72af303ce4dc in nsThread::ThreadFunc(void*) /gecko/xpcom/threads/nsThread.cpp:366:10
        #23 0x72af50c0761b in _pt_root /gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
        #24 0x62434175c368 in asan_thread_start(void*) /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:239:28
    
    ==26191==ABORTING

Jason Kratzer [:jkratzer]

Reporter

Comment 1

•

7 months ago

Attached file Detailed Crash Information — Details

Andrew McCreight [:mccr8]

Assignee

Comment 2

•

7 months ago

The PCamerasChild suggests it is some kind of media or WebRTC issue.

Component: DOM: Core & HTML → WebRTC: Audio/Video

Keywords: csectype-uaf, sec-high

Andrew McCreight [:mccr8]

Assignee

Updated

•

7 months ago

Group: core-security → media-core-security

Andrew McCreight [:mccr8]

Assignee

Comment 3

•

7 months ago

It looks like it is happening with the runnable created for AllocateCapture. Maybe something is going weird with how unique_id is created or copied?

Andrew McCreight [:mccr8]

Assignee

Comment 4

•

7 months ago

On second thought, it does look like aWindowID is being captured as a const uint64_t& which is clearly going to be a problem if we return from this method before calling send as it is a stack reference. I can't see why you wouldn't just make a copy, as the reference is the same size as the uint64_t.

Andrew McCreight [:mccr8]

Assignee

Comment 5

•

7 months ago

sec-high might be too high. I'm not sure how controllable the stack is here for this random media thread.

Keywords: sec-high → sec-moderate

Andrew McCreight [:mccr8]

Assignee

Comment 6

•

7 months ago

And the fact that this is a read not a write.

Andrew McCreight [:mccr8]

Assignee

Comment 7

•

7 months ago

Attached file Bug 1923706 - Pass by value, not reference in CamerasChild::AllocateCapture. — Details

Phabricator Automation

Updated

•

7 months ago

Assignee: nobody → continuation

Status: NEW → ASSIGNED

Andrew McCreight [:mccr8]

Assignee

Comment 8

•

7 months ago

Looks trivial so I threw together a patch. I'm not sure how to test this. It compiles at least!

Andrew McCreight [:mccr8]

Assignee

Comment 9

•

7 months ago

Before bug 1483631, there was a PrincipalInfo being passed in by reference, which seems worse, but maybe it wasn't on the stack so that was okay.

Andrew McCreight [:mccr8]

Assignee

Updated

•

7 months ago

status-firefox131: --- → wontfix

status-firefox132: --- → affected

status-firefox133: --- → affected

status-firefox-esr115: --- → affected

status-firefox-esr128: --- → affected

Pulsebot

Comment 10

•

7 months ago

Pushed by amccreight@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/56f900560a1c Pass by value, not reference in CamerasChild::AllocateCapture. r=pehrsons

Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)

Comment 11

•

7 months ago

https://hg.mozilla.org/mozilla-central/rev/56f900560a1c

Group: media-core-security → core-security-release

Status: ASSIGNED → RESOLVED

Closed: 7 months ago

status-firefox133: affected → fixed

Resolution: --- → FIXED

Target Milestone: --- → 133 Branch

Ryan VanderMeulen [:RyanVM]

Updated

•

7 months ago

status-firefox-esr115: affected → wontfix

tracking-firefox132: --- → +

tracking-firefox133: --- → +

tracking-firefox-esr128: --- → 132+

BugBot [:suhaib / :marco/ :calixte]

Comment 12

•

7 months ago

The patch landed in nightly and beta is affected.
:mccr8, is this bug important enough to require an uplift?

If yes, please nominate the patch for beta approval.
If no, please set status-firefox132 to wontfix.

For more information, please visit BugBot documentation.

Flags: needinfo?(continuation)

Andrew McCreight [:mccr8]

Assignee

Comment 13

•

7 months ago

Attached file Bug 1923706 - Pass by value, not reference in CamerasChild::AllocateCapture. — Details

Original Revision: https://phabricator.services.mozilla.com/D225121

Phabricator Automation

Updated

•

7 months ago

Attachment #9430410 - Flags: approval-mozilla-beta?

Phabricator Automation

Comment 14

•

7 months ago

beta Uplift Approval Request

User impact if declined: possible crashes or security problems
Code covered by automated testing: yes
Fix verified in Nightly: no
Needs manual QE test: no
Steps to reproduce for manual QE testing: N/A
Risk associated with taking this patch: low
Explanation of risk level: It only makes us pass an int in a less silly way
String changes made/needed: none
Is Android affected?: yes

Andrew McCreight [:mccr8]

Assignee

Updated

•

7 months ago

Flags: needinfo?(continuation)

Ryan VanderMeulen [:RyanVM]

Updated

•

7 months ago

Attachment #9430410 - Flags: approval-mozilla-esr128?

Phabricator Automation

Updated

•

7 months ago

Attachment #9430410 - Flags: approval-mozilla-beta? → approval-mozilla-beta+

Ryan VanderMeulen [:RyanVM]

Updated

•

7 months ago

Attachment #9430410 - Flags: approval-mozilla-esr128? → approval-mozilla-esr128+

Pulsebot

Comment 15

•

7 months ago

uplift

https://hg.mozilla.org/releases/mozilla-beta/rev/6a9437f19a16

Lando Automation

Updated

•

7 months ago

status-firefox132: affected → fixed

Ryan VanderMeulen [:RyanVM]

Updated

•

7 months ago

status-firefox-esr128: affected → fixed

Pulsebot

Comment 16

•

7 months ago

uplift

https://hg.mozilla.org/releases/mozilla-esr128/rev/bdea790bc9be

Andrei Vaida [:avaida]

Updated

•

7 months ago

QA Whiteboard: [post-critsmash-triage]

Flags: qe-verify-

Jesse Schwartzentruber (:truber)

Updated

•

7 months ago

Whiteboard: [bugmon:confirm] → [bugmon:confirm] [adv-main132+r] [adv-esr128.4+r]

Daniel Veditz [:dveditz]

Updated

•

28 days ago

Group: core-security-release

Detailed Crash Information 7 months ago Jason Kratzer [:jkratzer] 15.77 KB, text/plain		Details
Bug 1923706 - Pass by value, not reference in CamerasChild::AllocateCapture. 7 months ago Andrew McCreight [:mccr8] 48 bytes, text/x-phabricator-request		Details \| Review
Bug 1923706 - Pass by value, not reference in CamerasChild::AllocateCapture. 7 months ago Andrew McCreight [:mccr8] 48 bytes, text/x-phabricator-request	phab-bot : approval-mozilla-beta+ RyanVM : approval-mozilla-esr128+	Details \| Review