Closed
Bug 1941002
(CVE-2025-3028)
Opened 1 year ago
Closed 1 year ago
Firefox: JavaScript can run during XSLTProcessor transform, leading to use-after-free
Categories
(Core :: XSLT, defect)
Core
XSLT
Tracking
()
People
(Reporter: ifratric, Assigned: peterv)
References
Details
(Keywords: csectype-uaf, reporter-external, sec-high, Whiteboard: [disclosure deadline 2025-04-10][adv-main137+][adv-esr115.22+][adv-esr128.9+])
Attachments
(4 files, 4 external files, 2 obsolete files)
Steps to reproduce:
Please note:
This bug is subject to a 90-day disclosure deadline. If a fix for this
issue is made available to users before the end of the 90-day deadline,
this bug report will become public 30 days after the fix was made
available. Otherwise, this bug report will become public at the deadline.
The scheduled deadline is 2025-04-10.
For more details, see the Project Zero vulnerability disclosure policy:
https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-policy.html
For the discovery of the issue, please credit Ivan Fratric of Google Project Zero
Details:
In an older Firefox bug, https://bugzilla.mozilla.org/show_bug.cgi?id=1309630, it was demonstrated that JavaScript code can run while XSLTProcessor is performing a transform. This works because a xsl stylesheet can request other documents during transform, e.g. using DocumentFunctionCall which calls nsSyncLoader::LoadDocument, duirng which events can get processed, including JavaScript timeout events.
While the focus of the older bug was on JavaScript execution after the tab is closed, running JavaScript during XSLT transform also has dangerous consequences for memory safety. Firefox's XSLTProcessor is not written with this parallelism in mind, which can lead to various issues. The PoC included with this report triggers a use-after-free by deleting nodes from the source document during transform, while those nodes are referenced in Xpath node list.
However, there are probably many other ways an attacker can take advantage of this parallelism. The safest fix would be to disable JavaScript execution / event processing during XSLT transformations entirely.
The issue was reproduced with an ASAN build from the latest source code.
The PoC (in the form of python http server) is attached. After running it, just point Firefox to http://127.0.0.1:8000
ASAN log:
./mach run http://127.0.0.1:8000
=================================================================
==3771171==ERROR: AddressSanitizer: heap-use-after-free on address 0x50c000091b5c at pc 0x7ff78fae6ee7 bp 0x7fff7634bd10 sp 0x7fff7634bd08
READ of size 4 at 0x50c000091b5c thread T0 (Isolated Web Co)
#0 0x7ff78fae6ee6 in GetBoolFlag objdir-ff-asan/dist/include/nsINode.h:2047:12
#1 0x7ff78fae6ee6 in IsInUncomposedDoc objdir-ff-asan/dist/include/nsINode.h:773:43
#2 0x7ff78fae6ee6 in GetUncomposedDoc objdir-ff-asan/dist/include/nsINode.h:783:12
#3 0x7ff78fae6ee6 in txXPathNodeUtils::comparePosition(txXPathNode const&, txXPathNode const&) dom/xslt/xpath/txMozillaXPathTreeWalker.cpp:495:37
#4 0x7ff78faec18f in txNodeSet::add(txNodeSet const&, void (*)(txXPathNode*, txXPathNode const*, txXPathNode const*), void (*)(txXPathNode const*, txXPathNode const*)) dom/xslt/xpath/txNodeSet.cpp:198:7
#5 0x7ff78faf66e8 in addAndTransfer dom/xslt/xpath/txNodeSet.cpp:128:17
#6 0x7ff78faf66e8 in UnionExpr::evaluate(txIEvalContext*, txAExprResult**) dom/xslt/xpath/txUnionExpr.cpp:55:17
#7 0x7ff78fb13f9c in txCopyOf::execute(txExecutionState&) dom/xslt/xslt/txInstructions.cpp:328:16
#8 0x7ff78fb6e6f2 in txXSLTProcessor::execute(txExecutionState&) dom/xslt/xslt/txXSLTProcessor.cpp:46:17
#9 0x7ff78fb3739e in txMozillaXSLTProcessor::TransformToFragment(nsINode&, mozilla::dom::Document&, mozilla::ErrorResult&) dom/xslt/xslt/txMozillaXSLTProcessor.cpp:760:10
#10 0x7ff78a4f9a07 in mozilla::dom::XSLTProcessor_Binding::transformToFragment(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) objdir-ff-asan/dom/bindings/./XSLTProcessorBinding.cpp:1055:83
#11 0x7ff78aea44fa in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) dom/bindings/BindingUtils.cpp:3290:13
#12 0x7ff79299fe4f in CallJSNative js/src/vm/Interpreter.cpp:532:13
#13 0x7ff79299fe4f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) js/src/vm/Interpreter.cpp:628:12
#14 0x7ff7929b98bb in InternalCall js/src/vm/Interpreter.cpp:695:10
#15 0x7ff7929b98bb in CallFromStack js/src/vm/Interpreter.cpp:700:10
#16 0x7ff7929b98bb in js::Interpret(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:3338:16
#17 0x7ff79299ec0e in MaybeEnterInterpreterTrampoline js/src/vm/Interpreter.cpp:433:10
#18 0x7ff79299ec0e in js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:502:13
#19 0x7ff7929a3dcf in ExecuteKernel js/src/vm/Interpreter.cpp:893:13
#20 0x7ff7929a3dcf in js::Execute(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp:926:10
#21 0x7ff792b117d0 in ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) js/src/vm/CompilationAndEvaluation.cpp:601:10
#22 0x7ff792b11a90 in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) js/src/vm/CompilationAndEvaluation.cpp:625:10
#23 0x7ff78fd9c167 in ExecuteCompiledScript dom/script/ScriptLoader.cpp:2664:8
#24 0x7ff78fd9c167 in mozilla::dom::ScriptLoader::EvaluateScript(nsIGlobalObject*, JS::loader::ScriptLoadRequest*) dom/script/ScriptLoader.cpp:3148:7
#25 0x7ff78fd9aea8 in mozilla::dom::ScriptLoader::EvaluateScriptElement(JS::loader::ScriptLoadRequest*) dom/script/ScriptLoader.cpp:2733:10
#26 0x7ff78fd934c4 in mozilla::dom::ScriptLoader::ProcessRequest(JS::loader::ScriptLoadRequest*) dom/script/ScriptLoader.cpp:2365:10
#27 0x7ff78fd904c3 in mozilla::dom::ScriptLoader::ProcessInlineScript(nsIScriptElement*, JS::loader::ScriptKind) dom/script/ScriptLoader.cpp:1616:10
#28 0x7ff78fd784f0 in mozilla::dom::ScriptLoader::ProcessScriptElement(nsIScriptElement*) dom/script/ScriptLoader.cpp:1212:10
#29 0x7ff78fd77e02 in mozilla::dom::ScriptElement::MaybeProcessScript() dom/script/ScriptElement.cpp:210:18
#30 0x7ff7863a8526 in AttemptToExecute objdir-ff-asan/dist/include/nsIScriptElement.h:224:18
#31 0x7ff7863a8526 in nsHtml5TreeOpExecutor::RunScript(nsIContent*, bool) parser/html/nsHtml5TreeOpExecutor.cpp:900:22
#32 0x7ff7863a3fba in nsHtml5TreeOpExecutor::RunFlushLoop() parser/html/nsHtml5TreeOpExecutor.cpp:685:7
#33 0x7ff7863e842b in nsHtml5ExecutorFlusher::Run() parser/html/nsHtml5StreamParser.cpp:161:18
#34 0x7ff78413a84a in mozilla::RunnableTask::Run() xpcom/threads/TaskController.cpp:688:16
#35 0x7ff78411a90d in mozilla::TaskController::RunTask(mozilla::Task*) xpcom/threads/TaskController.cpp:215:19
#36 0x7ff784121870 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) xpcom/threads/TaskController.cpp:1015:20
#37 0x7ff78411f278 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) xpcom/threads/TaskController.cpp:838:15
#38 0x7ff78411f896 in mozilla::TaskController::ProcessPendingMTTask(bool) xpcom/threads/TaskController.cpp:624:36
#39 0x7ff7841293c1 in operator() xpcom/threads/TaskController.cpp:336:37
#40 0x7ff7841293c1 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() xpcom/threads/nsThreadUtils.h:548:5
#41 0x7ff78416ab8f in nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:1159:16
#42 0x7ff784174f60 in NS_ProcessNextEvent(nsIThread*, bool) xpcom/threads/nsThreadUtils.cpp:480:10
#43 0x7ff785b19a5f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:85:21
#44 0x7ff785953374 in RunInternal ipc/chromium/src/base/message_loop.cc:369:10
#45 0x7ff785953374 in RunHandler ipc/chromium/src/base/message_loop.cc:362:3
#46 0x7ff785953374 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:344:3
#47 0x7ff79028efac in nsBaseAppShell::Run() widget/nsBaseAppShell.cpp:148:27
#48 0x7ff79049740b in nsAppShell::Run() widget/gtk/nsAppShell.cpp:470:33
#49 0x7ff79259b3d5 in XRE_RunAppShell() toolkit/xre/nsEmbedFunctions.cpp:646:20
#50 0x7ff785953374 in RunInternal ipc/chromium/src/base/message_loop.cc:369:10
#51 0x7ff785953374 in RunHandler ipc/chromium/src/base/message_loop.cc:362:3
#52 0x7ff785953374 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:344:3
#53 0x7ff79259ac62 in XRE_InitChildProcess(int, char**, XREChildData const*) toolkit/xre/nsEmbedFunctions.cpp:584:34
#54 0x5587d53a39a9 in main browser/app/nsBrowserApp.cpp:397:22
#55 0x7ff7a2e40c89 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#56 0x7ff7a2e40d44 in __libc_start_main csu/../csu/libc-start.c:360:3
#57 0x5587d52c3058 in _start (objdir-ff-asan/dist/bin/firefox+0xcd058) (BuildId: a5f6b92e690df25dfe11a977d556c465)
0x50c000091b5c is located 28 bytes inside of 128-byte region [0x50c000091b40,0x50c000091bc0)
freed by thread T0 (Isolated Web Co) here:
#0 0x5587d53606b6 in free /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3
#1 0x7ff7889ce84d in Free dom/base/nsNodeInfoManager.h:115:27
#2 0x7ff7889ce84d in nsIContent::Destroy() dom/base/FragmentOrElement.cpp:136:1
#3 0x7ff783faa5b4 in MaybeKillObject xpcom/base/nsCycleCollector.cpp:2626:29
#4 0x7ff783faa5b4 in SnowWhiteKiller::Visit(nsPurpleBuffer&, nsPurpleBufferEntry*) xpcom/base/nsCycleCollector.cpp:2651:9
#5 0x7ff783f96cc8 in void nsPurpleBuffer::VisitEntries<SnowWhiteKiller>(SnowWhiteKiller&) xpcom/base/nsCycleCollector.cpp:997:27
#6 0x7ff783f7f758 in nsCycleCollector::FreeSnowWhiteWithBudget(JS::SliceBudget&) xpcom/base/nsCycleCollector.cpp:2819:14
#7 0x7ff785e01ddd in AsyncFreeSnowWhite::Run() js/xpconnect/src/XPCJSRuntime.cpp:164:9
#8 0x7ff7841926de in IdleRunnableWrapper::Run() xpcom/threads/nsThreadUtils.cpp:327:22
#9 0x7ff78413a84a in mozilla::RunnableTask::Run() xpcom/threads/TaskController.cpp:688:16
#10 0x7ff78411a90d in mozilla::TaskController::RunTask(mozilla::Task*) xpcom/threads/TaskController.cpp:215:19
#11 0x7ff784121870 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) xpcom/threads/TaskController.cpp:1015:20
#12 0x7ff78411f53b in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) xpcom/threads/TaskController.cpp:880:15
#13 0x7ff78411f896 in mozilla::TaskController::ProcessPendingMTTask(bool) xpcom/threads/TaskController.cpp:624:36
#14 0x7ff7841293f4 in operator() xpcom/threads/TaskController.cpp:339:37
#15 0x7ff7841293f4 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() xpcom/threads/nsThreadUtils.h:548:5
#16 0x7ff78416ab8f in nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:1159:16
#17 0x7ff7888097e2 in nsSyncLoader::PushAsyncStream(nsIStreamListener*) dom/base/nsSyncLoadService.cpp:217:20
#18 0x7ff788808929 in nsSyncLoader::LoadDocument(nsIChannel*, bool, bool, mozilla::dom::ReferrerPolicy, mozilla::dom::Document**) dom/base/nsSyncLoadService.cpp:181:10
#19 0x7ff78880aced in nsSyncLoadService::LoadDocument(nsIURI*, nsIContentPolicy::nsContentPolicyType, nsIPrincipal*, unsigned int, nsILoadGroup*, nsICookieJarSettings*, bool, mozilla::dom::ReferrerPolicy, mozilla::dom::Document**) dom/base/nsSyncLoadService.cpp:304:18
#20 0x7ff78fac7880 in txParseDocumentFromURI dom/xslt/xml/txXMLParser.cpp:38:8
#21 0x7ff78fb0b6d2 in txExecutionState::retrieveDocument(nsTSubstring<char16_t> const&) dom/xslt/xslt/txExecutionState.cpp:372:9
#22 0x7ff78fb00ac8 in retrieveNode(txExecutionState*, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, txNodeSet*) dom/xslt/xslt/txDocumentFunctionCall.cpp:44:50
#23 0x7ff78fb0045c in DocumentFunctionCall::evaluate(txIEvalContext*, txAExprResult**) dom/xslt/xslt/txDocumentFunctionCall.cpp:131:3
#24 0x7ff78faef2b1 in PathExpr::evaluate(txIEvalContext*, txAExprResult**) dom/xslt/xpath/txPathExpr.cpp:50:33
#25 0x7ff78faf651c in UnionExpr::evaluate(txIEvalContext*, txAExprResult**) dom/xslt/xpath/txUnionExpr.cpp:39:27
#26 0x7ff78fb13f9c in txCopyOf::execute(txExecutionState&) dom/xslt/xslt/txInstructions.cpp:328:16
#27 0x7ff78fb6e6f2 in txXSLTProcessor::execute(txExecutionState&) dom/xslt/xslt/txXSLTProcessor.cpp:46:17
#28 0x7ff78fb3739e in txMozillaXSLTProcessor::TransformToFragment(nsINode&, mozilla::dom::Document&, mozilla::ErrorResult&) dom/xslt/xslt/txMozillaXSLTProcessor.cpp:760:10
#29 0x7ff78a4f9a07 in mozilla::dom::XSLTProcessor_Binding::transformToFragment(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) objdir-ff-asan/dom/bindings/./XSLTProcessorBinding.cpp:1055:83
#30 0x7ff78aea44fa in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) dom/bindings/BindingUtils.cpp:3290:13
#31 0x7ff79299fe4f in CallJSNative js/src/vm/Interpreter.cpp:532:13
#32 0x7ff79299fe4f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) js/src/vm/Interpreter.cpp:628:12
#33 0x7ff7929b98bb in InternalCall js/src/vm/Interpreter.cpp:695:10
#34 0x7ff7929b98bb in CallFromStack js/src/vm/Interpreter.cpp:700:10
#35 0x7ff7929b98bb in js::Interpret(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:3338:16
previously allocated by thread T0 (Isolated Web Co) here:
#0 0x5587d536094f in malloc /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:68:3
#1 0x7ff7887d446a in Allocate objdir-ff-asan/dist/include/mozilla/dom/DOMArena.h:47:17
#2 0x7ff7887d446a in nsNodeInfoManager::Allocate(unsigned long) dom/base/nsNodeInfoManager.cpp:290:20
#3 0x7ff78fabab28 in NS_NewXMLElement(mozilla::dom::Element**, already_AddRefed<mozilla::dom::NodeInfo>&&) dom/xml/nsXMLElement.cpp:20:29
#4 0x7ff788d3b254 in NS_NewElement(mozilla::dom::Element**, already_AddRefed<mozilla::dom::NodeInfo>&&, mozilla::dom::FromParser, nsAtom*, mozilla::dom::CustomElementDefinition*) dom/base/nsNameSpaceManager.cpp:223:10
#5 0x7ff78fab0f09 in nsXMLContentSink::CreateElement(char16_t const**, unsigned int, mozilla::dom::NodeInfo*, unsigned int, unsigned int, nsIContent**, bool*, mozilla::dom::FromParser) dom/xml/nsXMLContentSink.cpp:528:10
#6 0x7ff78fab4fd2 in nsXMLContentSink::HandleStartElement(char16_t const*, char16_t const**, unsigned int, unsigned int, unsigned int, bool) dom/xml/nsXMLContentSink.cpp:984:12
#7 0x7ff78fab5d1a in HandleStartElement dom/xml/nsXMLContentSink.cpp:945:10
#8 0x7ff78fab5d1a in non-virtual thunk to nsXMLContentSink::HandleStartElement(char16_t const*, char16_t const**, unsigned int, unsigned int, unsigned int) dom/xml/nsXMLContentSink.cpp
#9 0x7ff7861e3a3c in nsExpatDriver::HandleStartElement(rlbox::rlbox_sandbox<rlbox::rlbox_wasm2c_sandbox>&, rlbox::tainted<void*, rlbox::rlbox_wasm2c_sandbox>, rlbox::tainted<char16_t const*, rlbox::rlbox_wasm2c_sandbox>, rlbox::tainted<char16_t const**, rlbox::rlbox_wasm2c_sandbox>) parser/htmlparser/nsExpatDriver.cpp:476:32
#10 0x7ff783e4f4fe in w2c_rlbox_doContent objdir-ff-asan/security/rlbox/rlbox.wasm.c:105111:5
#11 0x7ff783e4a28a in w2c_rlbox_doProlog objdir-ff-asan/security/rlbox/rlbox.wasm.c:101313:14
#12 0x7ff783e434b6 in w2c_rlbox_prologProcessor objdir-ff-asan/security/rlbox/rlbox.wasm.c:100458:12
#13 0x7ff783a5a536 in w2c_rlbox_MOZ_XML_Parse_0 objdir-ff-asan/security/rlbox/rlbox.wasm.c:99451:12
#14 0x7ff783a5a536 in w2c_rlbox_MOZ_XML_Parse objdir-ff-asan/security/rlbox/rlbox.wasm.c:17760:13
#15 0x7ff7861eb28e in impl_invoke_with_func_ptr<XML_Status (XML_ParserStruct *, const char *, int, int), XML_Status (unsigned int, unsigned int, int, int), unsigned int, unsigned int, unsigned int, bool> objdir-ff-asan/dist/include/mozilla/rlbox/rlbox_wasm2c_sandbox.hpp:815:13
#16 0x7ff7861eb28e in INTERNAL_invoke_with_func_ptr<XML_Status (XML_ParserStruct *, const char *, int, int), rlbox::tainted<XML_ParserStruct *, rlbox::rlbox_wasm2c_sandbox> &, rlbox::tainted<const char *, rlbox::rlbox_wasm2c_sandbox>, unsigned long, bool> objdir-ff-asan/dist/include/mozilla/rlbox/rlbox_sandbox.hpp:790:40
#17 0x7ff7861eb28e in nsExpatDriver::ParseChunk(char16_t const*, unsigned int, nsExpatDriver::ChunkOrBufferIsFinal, unsigned int*, unsigned long*) parser/htmlparser/nsExpatDriver.cpp:1237:14
#18 0x7ff7861ec412 in ChunkAndParseBuffer parser/htmlparser/nsExpatDriver.cpp:1193:3
#19 0x7ff7861ec412 in nsExpatDriver::ResumeParse(nsScanner&, bool) parser/htmlparser/nsExpatDriver.cpp:1341:5
#20 0x7ff7861f82ed in nsParser::ResumeParse(bool, bool, bool) parser/htmlparser/nsParser.cpp:716:24
#21 0x7ff7861fb0c3 in nsParser::OnDataAvailable(nsIRequest*, nsIInputStream*, unsigned long, unsigned int) parser/htmlparser/nsParser.cpp:1027:12
#22 0x7ff788787b6b in mozilla::dom::DOMParser::ParseFromStream(nsIInputStream*, nsTSubstring<char16_t> const&, int, mozilla::dom::SupportedType, mozilla::ErrorResult&) dom/base/DOMParser.cpp:247:20
#23 0x7ff788786b04 in mozilla::dom::DOMParser::ParseFromStringInternal(nsTSubstring<char16_t> const&, mozilla::dom::SupportedType, mozilla::ErrorResult&) dom/base/DOMParser.cpp:100:10
#24 0x7ff7887883d3 in mozilla::dom::DOMParser::ParseFromString(mozilla::dom::TrustedHTMLOrString const&, mozilla::dom::SupportedType, mozilla::ErrorResult&) dom/base/DOMParser.cpp:118:10
#25 0x7ff78a7b18cb in mozilla::dom::DOMParser_Binding::parseFromString(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) objdir-ff-asan/dom/bindings/./DOMParserBinding.cpp:97:75
#26 0x7ff78aea44fa in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) dom/bindings/BindingUtils.cpp:3290:13
#27 0x7ff79299fe4f in CallJSNative js/src/vm/Interpreter.cpp:532:13
#28 0x7ff79299fe4f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) js/src/vm/Interpreter.cpp:628:12
#29 0x7ff7929b98bb in InternalCall js/src/vm/Interpreter.cpp:695:10
#30 0x7ff7929b98bb in CallFromStack js/src/vm/Interpreter.cpp:700:10
#31 0x7ff7929b98bb in js::Interpret(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:3338:16
#32 0x7ff79299ec0e in MaybeEnterInterpreterTrampoline js/src/vm/Interpreter.cpp:433:10
#33 0x7ff79299ec0e in js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:502:13
#34 0x7ff7929a3dcf in ExecuteKernel js/src/vm/Interpreter.cpp:893:13
#35 0x7ff7929a3dcf in js::Execute(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp:926:10
#36 0x7ff792b117d0 in ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) js/src/vm/CompilationAndEvaluation.cpp:601:10
#37 0x7ff792b11a90 in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) js/src/vm/CompilationAndEvaluation.cpp:625:10
#38 0x7ff78fd9c167 in ExecuteCompiledScript dom/script/ScriptLoader.cpp:2664:8
#39 0x7ff78fd9c167 in mozilla::dom::ScriptLoader::EvaluateScript(nsIGlobalObject*, JS::loader::ScriptLoadRequest*) dom/script/ScriptLoader.cpp:3148:7
#40 0x7ff78fd9aea8 in mozilla::dom::ScriptLoader::EvaluateScriptElement(JS::loader::ScriptLoadRequest*) dom/script/ScriptLoader.cpp:2733:10
#41 0x7ff78fd934c4 in mozilla::dom::ScriptLoader::ProcessRequest(JS::loader::ScriptLoadRequest*) dom/script/ScriptLoader.cpp:2365:10
SUMMARY: AddressSanitizer: heap-use-after-free objdir-ff-asan/dist/include/nsINode.h:2047:12 in GetBoolFlag
Shadow bytes around the buggy address:
0x50c000091880: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
0x50c000091900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x50c000091980: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x50c000091a00: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
0x50c000091a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
=>0x50c000091b00: fa fa fa fa fa fa fa fa fd fd fd[fd]fd fd fd fd
0x50c000091b80: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
0x50c000091c00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
0x50c000091c80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x50c000091d00: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
0x50c000091d80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==3771171==ABORTING
|
||
Updated•1 year ago
|
Group: firefox-core-security → dom-core-security
Component: Untriaged → XSLT
Flags: needinfo?(peterv)
Keywords: csectype-uaf,
sec-high
Product: Firefox → Core
|
||
Updated•1 year ago
|
status-firefox134:
--- → wontfix
status-firefox135:
--- → affected
status-firefox136:
--- → affected
tracking-firefox135:
--- → +
tracking-firefox136:
--- → +
See Also: → CVE-2022-22755
Whiteboard: [disclosure deadline 2025-04-10]
|
Reporter | |
Comment 1•1 year ago
|
||
Update:
In addition to JavaScript running during transform, it's also possible for JavaScript to run during stylesheet compilation, also resulting to use-after free. This is because, during compilation, when processing stylesheet includes/imports, txSyncCompileObserver::loadURI calls nsSyncLoadService::LoadDocument, which once again allows JavaScript handlers to run.
Please let me know if I should post a PoC and the ASAN log here, or open a separate bug for the compilation case.
|
||
Comment 2•1 year ago
|
||
The bug is marked as tracked for firefox135 (beta) and tracked for firefox136 (nightly). However, the bug still isn't assigned.
:hsinyi, could you please find an assignee for this tracked bug? If you disagree with the tracking decision, please talk with the release managers.
For more information, please visit BugBot documentation.
Flags: needinfo?(htsai)
|
|
||
Comment 3•1 year ago
|
||
(In reply to Ivan Fratric from comment #1)
Please let me know if I should post a PoC and the ASAN log here, or open a separate bug for the compilation case.
Thank you. Please file a new issue. It is usually easier to combine two issues into one if they end up having a single fix than splitting one issues into two.
|
|
Reporter | |
Comment 4•1 year ago
|
||
Thanks, I just filed https://bugzilla.mozilla.org/show_bug.cgi?id=1941352 for the compilation variant.
|
|
||
Updated•1 year ago
|
Keywords: reporter-external
|
||
Updated•1 year ago
|
status-firefox-esr115:
--- → affected
status-firefox-esr128:
--- → affected
tracking-firefox-esr115:
--- → 135+
tracking-firefox-esr128:
--- → 135+
|
||
Comment 5•1 year ago
|
||
Assign this to Peter, who has been looking at this.
Assignee: nobody → peterv
Flags: needinfo?(htsai)
|
Assignee | |
Updated•1 year ago
|
Flags: needinfo?(peterv)
|
|
||
Updated•1 year ago
|
Severity: -- → S2
|
|
Assignee | |
Comment 7•1 year ago
|
||
|
|
Assignee | |
Comment 8•1 year ago
|
||
|
|
||
Updated•1 year ago
|
|
|
Assignee | |
Comment 9•1 year ago
|
||
|
||
Updated•1 year ago
|
Attachment #9460505 -
Attachment description: WIP: Bug 1941002 - Don't deliver event during XSLT transform. → Bug 1941002 - Don't deliver event during XSLT transform. r?smaug!
|
|
||
Updated•1 year ago
|
Attachment #9460506 -
Attachment description: WIP: Bug 1941002: Testcase. → Bug 1941002 - Testcase. r?smaug!
|
|
Assignee | |
Comment 10•1 year ago
|
||
|
|
Assignee | |
Comment 11•1 year ago
|
||
Comment on attachment 9461852 [details]
Bug 1941002 - Clone source. r?smaug!
Security Approval Request
- How easily could an exploit be constructed based on the patch?: Not super obvious. It's adding strong references, but no obvious references how one can run script while the raw pointers were on the stack.
- Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
- Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: All
- If not all supported branches, which bug introduced the flaw?: None
- Do you have backports for the affected branches?: No
- If not, how different, hard to create, and risky will they be?: Should be trivial.
- How likely is this patch to cause regressions; how much testing does it need?: Might have small performance regression when using XSLT transforms through the DOM API. Should be very rare.
- Is the patch ready to land after security approval is given?: Yes
- Is Android affected?: Yes
Attachment #9461852 -
Flags: sec-approval?
|
||
Comment 12•1 year ago
|
||
Comment on attachment 9461852 [details]
Bug 1941002 - Clone source. r?smaug!
Approved to land and request uplift. Little unclear about how many patches are needed, but D234845 looks alright too.
Attachment #9461852 -
Flags: sec-approval? → sec-approval+
|
|
||
Updated•1 year ago
|
Whiteboard: [disclosure deadline 2025-04-10] → [disclosure deadline 2025-04-10][reminder-test 2025-04-15]
|
||
Updated•1 year ago
|
status-firefox137:
--- → affected
tracking-firefox137:
--- → +
|
|
Assignee | |
Comment 13•1 year ago
|
||
(In reply to Tom Ritter [:tjr] from comment #12)
Approved to land and request uplift. Little unclear about how many patches are needed, but D234845 looks alright too.
I'm not planning to land D234845 in this bug. It's not strictly needed to fix this particular issue, but would still be good to have. I'll move it to a separate bug (but need to be careful not to expose too much about this bug).
|
||
Comment 14•1 year ago
|
||
Pushed by pvanderbeken@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/a59f102fa3bb
Clone source. r=smaug
|
||
Comment 15•1 year ago
|
||
Group: dom-core-security → core-security-release
Status: NEW → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → 137 Branch
|
|
||
Comment 16•1 year ago
|
||
The patch landed in nightly and beta is affected.
:peterv, is this bug important enough to require an uplift?
- If yes, please nominate the patch for beta approval.
- If no, please set
status-firefox136towontfix.
For more information, please visit BugBot documentation.
Flags: needinfo?(peterv)
|
|
||
Comment 17•1 year ago
|
||
In addition to the request in Comment 16, please add uplift requests for esr115 and esr128.
|
|
Reporter | |
Comment 18•1 year ago
|
||
Folks, I see you marked this bug as fixed without D234845 landing, but I have to disagree. The fact that XSLTProcessor is not designed with JavaScript running during compilation / transformation in mind is the main issue here, not the two individual (now fixed) uaf instances I reported.
To prove this, I am attaching a third variant that still triggers an UAF even with the D235577 applied (see parameters.py in attachments). ASAN log on the latest source is at the end of the message.
The (fourth?) variant I thought about but haven't managed to turn into a UAF (at least yet) is to call transformToDocument and then transformToDocument again during callback, which clobbers mSource (containing the copied source).
Regardless if this is four variants or "just" three (so far), my concern is that hunting individual instances where a JavaScript event during XSLT processing can trigger a use-after-free is going to be a futile game of whack-a-mole, without a more comprehensive fix. At the same time, releasing the bug with only the current fix is going to mean an open season for variants.
=================================================================
==1862563==ERROR: AddressSanitizer: heap-use-after-free on address 0x50c00008da28 at pc 0x7fd04fbd5ccd bp 0x7ffdaa2cf6b0 sp 0x7ffdaa2cf6a8
READ of size 8 at 0x50c00008da28 thread T0 (Isolated Web Co)
#0 0x7fd04fbd5ccc in get objdir-ff-asan/dist/include/mozilla/RefPtr.h:314:27
#1 0x7fd04fbd5ccc in operator-> objdir-ff-asan/dist/include/mozilla/RefPtr.h:344:12
#2 0x7fd04fbd5ccc in NodeType objdir-ff-asan/dist/include/nsINode.h:829:38
#3 0x7fd04fbd5ccc in IsText objdir-ff-asan/dist/include/nsINode.h:619:25
#4 0x7fd04fbd5ccc in isText dom/xslt/xpath/txXPathTreeWalker.h:198:48
#5 0x7fd04fbd5ccc in txNodeTypeTest::matches(txXPathNode const&, txIMatchContext*, bool&) dom/xslt/xpath/txNodeTypeTest.cpp:36:11
#6 0x7fd04fbca986 in appendIfMatching dom/xslt/xpath/txLocationStep.cpp:197:28
#7 0x7fd04fbca986 in LocationStep::evaluate(txIEvalContext*, txAExprResult**) dom/xslt/xpath/txLocationStep.cpp:161:12
#8 0x7fd04fbfb51c in txCopyOf::execute(txExecutionState&) dom/xslt/xslt/txInstructions.cpp:328:16
#9 0x7fd04fc55d52 in txXSLTProcessor::execute(txExecutionState&) dom/xslt/xslt/txXSLTProcessor.cpp:46:17
#10 0x7fd04fc1e72b in txMozillaXSLTProcessor::TransformToFragment(nsINode&, bool, mozilla::dom::Document&, mozilla::ErrorResult&) dom/xslt/xslt/txMozillaXSLTProcessor.cpp:774:10
#11 0x7fd04a61928c in TransformToFragment objdir-ff-asan/dist/include/mozilla/dom/txMozillaXSLTProcessor.h:99:12
#12 0x7fd04a61928c in mozilla::dom::XSLTProcessor_Binding::transformToFragment(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) objdir-ff-asan/dom/bindings/./XSLTProcessorBinding.cpp:1055:83
#13 0x7fd04af7b91a in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) dom/bindings/BindingUtils.cpp:3302:13
#14 0x7fd052a0baff in CallJSNative js/src/vm/Interpreter.cpp:532:13
#15 0x7fd052a0baff in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) js/src/vm/Interpreter.cpp:628:12
#16 0x7fd052a25a37 in InternalCall js/src/vm/Interpreter.cpp:695:10
#17 0x7fd052a25a37 in CallFromStack js/src/vm/Interpreter.cpp:700:10
#18 0x7fd052a25a37 in js::Interpret(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:3338:16
#19 0x7fd052a0a94e in MaybeEnterInterpreterTrampoline js/src/vm/Interpreter.cpp:433:10
#20 0x7fd052a0a94e in js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:502:13
#21 0x7fd052a0f9c1 in ExecuteKernel js/src/vm/Interpreter.cpp:893:13
#22 0x7fd052a0f9c1 in js::Execute(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp:926:10
#23 0x7fd052b75d09 in ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) js/src/vm/CompilationAndEvaluation.cpp:601:10
#24 0x7fd052b75f80 in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) js/src/vm/CompilationAndEvaluation.cpp:625:10
#25 0x7fd04fe86527 in ExecuteCompiledScript dom/script/ScriptLoader.cpp:2664:8
#26 0x7fd04fe86527 in mozilla::dom::ScriptLoader::EvaluateScript(nsIGlobalObject*, JS::loader::ScriptLoadRequest*) dom/script/ScriptLoader.cpp:3148:7
#27 0x7fd04fe85268 in mozilla::dom::ScriptLoader::EvaluateScriptElement(JS::loader::ScriptLoadRequest*) dom/script/ScriptLoader.cpp:2733:10
#28 0x7fd04fe7dfb4 in mozilla::dom::ScriptLoader::ProcessRequest(JS::loader::ScriptLoadRequest*) dom/script/ScriptLoader.cpp:2365:10
#29 0x7fd04fe7ae93 in mozilla::dom::ScriptLoader::ProcessInlineScript(nsIScriptElement*, JS::loader::ScriptKind) dom/script/ScriptLoader.cpp:1616:10
#30 0x7fd04fe62de0 in mozilla::dom::ScriptLoader::ProcessScriptElement(nsIScriptElement*) dom/script/ScriptLoader.cpp:1212:10
#31 0x7fd04fe626f2 in mozilla::dom::ScriptElement::MaybeProcessScript() dom/script/ScriptElement.cpp:210:18
#32 0x7fd04656ac86 in AttemptToExecute objdir-ff-asan/dist/include/nsIScriptElement.h:224:18
#33 0x7fd04656ac86 in nsHtml5TreeOpExecutor::RunScript(nsIContent*, bool) parser/html/nsHtml5TreeOpExecutor.cpp:915:22
#34 0x7fd04656673b in nsHtml5TreeOpExecutor::RunFlushLoop() parser/html/nsHtml5TreeOpExecutor.cpp:694:7
#35 0x7fd0465a965b in nsHtml5ExecutorFlusher::Run() parser/html/nsHtml5StreamParser.cpp:161:18
#36 0x7fd0443de93a in mozilla::RunnableTask::Run() xpcom/threads/TaskController.cpp:714:16
#37 0x7fd0443bf40d in mozilla::TaskController::RunTask(mozilla::Task*) xpcom/threads/TaskController.cpp:218:19
#38 0x7fd0443c62c0 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) xpcom/threads/TaskController.cpp:1143:20
#39 0x7fd0443c3cc8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) xpcom/threads/TaskController.cpp:966:15
#40 0x7fd0443c42e6 in mozilla::TaskController::ProcessPendingMTTask(bool) xpcom/threads/TaskController.cpp:650:36
#41 0x7fd0443cdba1 in operator() xpcom/threads/TaskController.cpp:351:37
#42 0x7fd0443cdba1 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() xpcom/threads/nsThreadUtils.h:548:5
#43 0x7fd04440e65f in nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:1159:16
#44 0x7fd044418740 in NS_ProcessNextEvent(nsIThread*, bool) xpcom/threads/nsThreadUtils.cpp:480:10
#45 0x7fd045d172bf in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:85:21
#46 0x7fd045b61a64 in RunInternal ipc/chromium/src/base/message_loop.cc:369:10
#47 0x7fd045b61a64 in RunHandler ipc/chromium/src/base/message_loop.cc:362:3
#48 0x7fd045b61a64 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:344:3
#49 0x7fd050378e6c in nsBaseAppShell::Run() widget/nsBaseAppShell.cpp:148:27
#50 0x7fd0505719ab in nsAppShell::Run() widget/gtk/nsAppShell.cpp:470:33
#51 0x7fd05260b355 in XRE_RunAppShell() toolkit/xre/nsEmbedFunctions.cpp:646:20
#52 0x7fd045b61a64 in RunInternal ipc/chromium/src/base/message_loop.cc:369:10
#53 0x7fd045b61a64 in RunHandler ipc/chromium/src/base/message_loop.cc:362:3
#54 0x7fd045b61a64 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:344:3
#55 0x7fd05260a7bf in XRE_InitChildProcess(int, char**, XREChildData const*) toolkit/xre/nsEmbedFunctions.cpp:584:34
#56 0x55abff60d829 in main browser/app/nsBrowserApp.cpp:397:22
#57 0x7fd062f31c89 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#58 0x7fd062f31d44 in __libc_start_main csu/../csu/libc-start.c:360:3
#59 0x55abff52ced8 in _start (objdir-ff-asan/dist/bin/firefox+0xcced8) (BuildId: 5096f3c0a5c762fcb7d6894b6b9d8d93)
0x50c00008da28 is located 40 bytes inside of 128-byte region [0x50c00008da00,0x50c00008da80)
freed by thread T0 (Isolated Web Co) here:
#0 0x55abff5ca536 in free /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3
#1 0x7fd048b7294d in Free dom/base/nsNodeInfoManager.h:115:27
#2 0x7fd048b7294d in nsIContent::Destroy() dom/base/FragmentOrElement.cpp:136:1
#3 0x7fd0442545d4 in MaybeKillObject xpcom/base/nsCycleCollector.cpp:2632:29
#4 0x7fd0442545d4 in SnowWhiteKiller::Visit(nsPurpleBuffer&, nsPurpleBufferEntry*) xpcom/base/nsCycleCollector.cpp:2657:9
#5 0x7fd0442407b8 in void nsPurpleBuffer::VisitEntries<SnowWhiteKiller>(SnowWhiteKiller&) xpcom/base/nsCycleCollector.cpp:1002:27
#6 0x7fd044228b98 in nsCycleCollector::FreeSnowWhiteWithBudget(JS::SliceBudget&) xpcom/base/nsCycleCollector.cpp:2825:14
#7 0x7fd045fdfeed in AsyncFreeSnowWhite::Run() js/xpconnect/src/XPCJSRuntime.cpp:165:9
#8 0x7fd044435ede in IdleRunnableWrapper::Run() xpcom/threads/nsThreadUtils.cpp:327:22
#9 0x7fd0443de93a in mozilla::RunnableTask::Run() xpcom/threads/TaskController.cpp:714:16
#10 0x7fd0443bf40d in mozilla::TaskController::RunTask(mozilla::Task*) xpcom/threads/TaskController.cpp:218:19
#11 0x7fd0443c62c0 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) xpcom/threads/TaskController.cpp:1143:20
#12 0x7fd0443c3f8b in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) xpcom/threads/TaskController.cpp:1008:15
#13 0x7fd0443c42e6 in mozilla::TaskController::ProcessPendingMTTask(bool) xpcom/threads/TaskController.cpp:650:36
#14 0x7fd0443cdbd4 in operator() xpcom/threads/TaskController.cpp:354:37
#15 0x7fd0443cdbd4 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() xpcom/threads/nsThreadUtils.h:548:5
#16 0x7fd04440e65f in nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:1159:16
#17 0x7fd0489ada72 in nsSyncLoader::PushAsyncStream(nsIStreamListener*) dom/base/nsSyncLoadService.cpp:217:20
#18 0x7fd0489acbb9 in nsSyncLoader::LoadDocument(nsIChannel*, bool, bool, mozilla::dom::ReferrerPolicy, mozilla::dom::Document**) dom/base/nsSyncLoadService.cpp:181:10
#19 0x7fd0489aef77 in nsSyncLoadService::LoadDocument(nsIURI*, nsIContentPolicy::nsContentPolicyType, nsIPrincipal*, unsigned int, nsILoadGroup*, nsICookieJarSettings*, bool, mozilla::dom::ReferrerPolicy, mozilla::dom::Document**) dom/base/nsSyncLoadService.cpp:304:18
#20 0x7fd04fbaf760 in txParseDocumentFromURI dom/xslt/xml/txXMLParser.cpp:38:8
#21 0x7fd04fbf2dd2 in txExecutionState::retrieveDocument(nsTSubstring<char16_t> const&) dom/xslt/xslt/txExecutionState.cpp:372:9
#22 0x7fd04fbe8248 in retrieveNode(txExecutionState*, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, txNodeSet*) dom/xslt/xslt/txDocumentFunctionCall.cpp:44:50
#23 0x7fd04fbe7bdc in DocumentFunctionCall::evaluate(txIEvalContext*, txAExprResult**) dom/xslt/xslt/txDocumentFunctionCall.cpp:131:3
#24 0x7fd04fbd6eb1 in PathExpr::evaluate(txIEvalContext*, txAExprResult**) dom/xslt/xpath/txPathExpr.cpp:50:33
#25 0x7fd04fbfc7ee in txLREAttribute::execute(txExecutionState&) dom/xslt/xslt/txInstructions.cpp:427:25
#26 0x7fd04fc55d52 in txXSLTProcessor::execute(txExecutionState&) dom/xslt/xslt/txXSLTProcessor.cpp:46:17
#27 0x7fd04fc1e72b in txMozillaXSLTProcessor::TransformToFragment(nsINode&, bool, mozilla::dom::Document&, mozilla::ErrorResult&) dom/xslt/xslt/txMozillaXSLTProcessor.cpp:774:10
#28 0x7fd04a61928c in TransformToFragment objdir-ff-asan/dist/include/mozilla/dom/txMozillaXSLTProcessor.h:99:12
#29 0x7fd04a61928c in mozilla::dom::XSLTProcessor_Binding::transformToFragment(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) objdir-ff-asan/dom/bindings/./XSLTProcessorBinding.cpp:1055:83
#30 0x7fd04af7b91a in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) dom/bindings/BindingUtils.cpp:3302:13
#31 0x7fd052a0baff in CallJSNative js/src/vm/Interpreter.cpp:532:13
#32 0x7fd052a0baff in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) js/src/vm/Interpreter.cpp:628:12
#33 0x7fd052a25a37 in InternalCall js/src/vm/Interpreter.cpp:695:10
#34 0x7fd052a25a37 in CallFromStack js/src/vm/Interpreter.cpp:700:10
#35 0x7fd052a25a37 in js::Interpret(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:3338:16
#36 0x7fd052a0a94e in MaybeEnterInterpreterTrampoline js/src/vm/Interpreter.cpp:433:10
#37 0x7fd052a0a94e in js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:502:13
previously allocated by thread T0 (Isolated Web Co) here:
#0 0x55abff5ca7cf in malloc /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:68:3
#1 0x7fd04897921a in Allocate objdir-ff-asan/dist/include/mozilla/dom/DOMArena.h:47:17
#2 0x7fd04897921a in nsNodeInfoManager::Allocate(unsigned long) dom/base/nsNodeInfoManager.cpp:290:20
#3 0x7fd04fba3138 in NS_NewXMLElement(mozilla::dom::Element**, already_AddRefed<mozilla::dom::NodeInfo>&&) dom/xml/nsXMLElement.cpp:20:29
#4 0x7fd048f0bad4 in NS_NewElement(mozilla::dom::Element**, already_AddRefed<mozilla::dom::NodeInfo>&&, mozilla::dom::FromParser, nsAtom*, mozilla::dom::CustomElementDefinition*) dom/base/nsNameSpaceManager.cpp:223:10
#5 0x7fd04fb9963b in nsXMLContentSink::CreateElement(char16_t const**, unsigned int, mozilla::dom::NodeInfo*, unsigned int, unsigned int, nsIContent**, bool*, mozilla::dom::FromParser) dom/xml/nsXMLContentSink.cpp:528:10
#6 0x7fd04fb9d822 in nsXMLContentSink::HandleStartElement(char16_t const*, char16_t const**, unsigned int, unsigned int, unsigned int, bool) dom/xml/nsXMLContentSink.cpp:984:12
#7 0x7fd04fb9e3ea in HandleStartElement dom/xml/nsXMLContentSink.cpp:945:10
#8 0x7fd04fb9e3ea in non-virtual thunk to nsXMLContentSink::HandleStartElement(char16_t const*, char16_t const**, unsigned int, unsigned int, unsigned int) dom/xml/nsXMLContentSink.cpp
#9 0x7fd0463b390c in nsExpatDriver::HandleStartElement(rlbox::rlbox_sandbox<rlbox::rlbox_wasm2c_sandbox>&, rlbox::tainted<void*, rlbox::rlbox_wasm2c_sandbox>, rlbox::tainted<char16_t const*, rlbox::rlbox_wasm2c_sandbox>, rlbox::tainted<char16_t const**, rlbox::rlbox_wasm2c_sandbox>) parser/htmlparser/nsExpatDriver.cpp:476:32
#10 0x7fd043ad12e6 in w2c_rlbox_doContent objdir-ff-asan/security/rlbox/rlbox.wasm_2.c:5622:5
#11 0x7fd043ac77a0 in w2c_rlbox_doProlog objdir-ff-asan/security/rlbox/rlbox.wasm_2.c:2322:14
#12 0x7fd043d5994c in w2c_rlbox_prologProcessor objdir-ff-asan/security/rlbox/rlbox.wasm_5.c:420:12
#13 0x7fd0432ade15 in w2c_rlbox_MOZ_XML_Parse_0 objdir-ff-asan/security/rlbox/rlbox.wasm_0.c:85083:12
#14 0x7fd0463baf0e in impl_invoke_with_func_ptr<XML_Status (XML_ParserStruct *, const char *, int, int), XML_Status (unsigned int, unsigned int, int, int), unsigned int, unsigned int, unsigned int, bool> objdir-ff-asan/dist/include/mozilla/rlbox/rlbox_wasm2c_sandbox.hpp:815:13
#15 0x7fd0463baf0e in INTERNAL_invoke_with_func_ptr<XML_Status (XML_ParserStruct *, const char *, int, int), rlbox::tainted<XML_ParserStruct *, rlbox::rlbox_wasm2c_sandbox> &, rlbox::tainted<const char *, rlbox::rlbox_wasm2c_sandbox>, unsigned long, bool> objdir-ff-asan/dist/include/mozilla/rlbox/rlbox_sandbox.hpp:790:40
#16 0x7fd0463baf0e in nsExpatDriver::ParseChunk(char16_t const*, unsigned int, nsExpatDriver::ChunkOrBufferIsFinal, unsigned int*, unsigned long*) parser/htmlparser/nsExpatDriver.cpp:1237:14
#17 0x7fd0463bbe56 in ChunkAndParseBuffer parser/htmlparser/nsExpatDriver.cpp:1193:3
#18 0x7fd0463bbe56 in nsExpatDriver::ResumeParse(nsScanner&, bool) parser/htmlparser/nsExpatDriver.cpp:1341:5
#19 0x7fd0463c7d6d in nsParser::ResumeParse(bool, bool, bool) parser/htmlparser/nsParser.cpp:717:24
#20 0x7fd0463cab44 in nsParser::OnDataAvailable(nsIRequest*, nsIInputStream*, unsigned long, unsigned int) parser/htmlparser/nsParser.cpp:1028:12
#21 0x7fd04892bb7b in mozilla::dom::DOMParser::ParseFromStream(nsIInputStream*, nsTSubstring<char16_t> const&, int, mozilla::dom::SupportedType, mozilla::ErrorResult&) dom/base/DOMParser.cpp:247:20
#22 0x7fd04892ab64 in mozilla::dom::DOMParser::ParseFromStringInternal(nsTSubstring<char16_t> const&, mozilla::dom::SupportedType, mozilla::ErrorResult&) dom/base/DOMParser.cpp:100:10
#23 0x7fd04892c3b3 in mozilla::dom::DOMParser::ParseFromString(mozilla::dom::TrustedHTMLOrString const&, mozilla::dom::SupportedType, mozilla::ErrorResult&) dom/base/DOMParser.cpp:118:10
#24 0x7fd04a8c08db in mozilla::dom::DOMParser_Binding::parseFromString(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) objdir-ff-asan/dom/bindings/./DOMParserBinding.cpp:97:75
#25 0x7fd04af7b91a in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) dom/bindings/BindingUtils.cpp:3302:13
#26 0x7fd052a0baff in CallJSNative js/src/vm/Interpreter.cpp:532:13
#27 0x7fd052a0baff in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) js/src/vm/Interpreter.cpp:628:12
#28 0x7fd052a25a37 in InternalCall js/src/vm/Interpreter.cpp:695:10
#29 0x7fd052a25a37 in CallFromStack js/src/vm/Interpreter.cpp:700:10
#30 0x7fd052a25a37 in js::Interpret(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:3338:16
#31 0x7fd052a0a94e in MaybeEnterInterpreterTrampoline js/src/vm/Interpreter.cpp:433:10
#32 0x7fd052a0a94e in js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:502:13
#33 0x7fd052a0f9c1 in ExecuteKernel js/src/vm/Interpreter.cpp:893:13
#34 0x7fd052a0f9c1 in js::Execute(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp:926:10
#35 0x7fd052b75d09 in ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) js/src/vm/CompilationAndEvaluation.cpp:601:10
#36 0x7fd052b75f80 in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) js/src/vm/CompilationAndEvaluation.cpp:625:10
#37 0x7fd04fe86527 in ExecuteCompiledScript dom/script/ScriptLoader.cpp:2664:8
#38 0x7fd04fe86527 in mozilla::dom::ScriptLoader::EvaluateScript(nsIGlobalObject*, JS::loader::ScriptLoadRequest*) dom/script/ScriptLoader.cpp:3148:7
#39 0x7fd04fe85268 in mozilla::dom::ScriptLoader::EvaluateScriptElement(JS::loader::ScriptLoadRequest*) dom/script/ScriptLoader.cpp:2733:10
#40 0x7fd04fe7dfb4 in mozilla::dom::ScriptLoader::ProcessRequest(JS::loader::ScriptLoadRequest*) dom/script/ScriptLoader.cpp:2365:10
SUMMARY: AddressSanitizer: heap-use-after-free objdir-ff-asan/dist/include/mozilla/RefPtr.h:314:27 in get
Shadow bytes around the buggy address:
0x50c00008d780: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x50c00008d800: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
0x50c00008d880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
0x50c00008d900: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x50c00008d980: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
=>0x50c00008da00: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd
0x50c00008da80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x50c00008db00: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
0x50c00008db80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
0x50c00008dc00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x50c00008dc80: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==1862563==ABORTING
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
|
|
Reporter | |
Comment 19•1 year ago
|
||
|
|
||
Updated•1 year ago
|
Target Milestone: 137 Branch → ---
|
|
Reporter | |
Comment 20•1 year ago
|
||
|
|
Reporter | |
Comment 21•1 year ago
|
||
Here is yet another variant that bypasses D235577 (PoC in poc_compilation2.py):
=================================================================
==1870935==ERROR: AddressSanitizer: heap-use-after-free on address 0x511000078b90 at pc 0x7fe0242d05b6 bp 0x7ffd79bf74f0 sp 0x7ffd79bf74e8
READ of size 8 at 0x511000078b90 thread T0 (Isolated Web Co)
#0 0x7fe0242d05b5 in operator++ objdir-ff-asan/dist/include/mozilla/DoublyLinkedList.h:152:58
#1 0x7fe0242d05b5 in SafeIterator objdir-ff-asan/dist/include/mozilla/DoublyLinkedList.h:419:29
#2 0x7fe0242d05b5 in begin objdir-ff-asan/dist/include/mozilla/DoublyLinkedList.h:504:33
#3 0x7fe0242d05b5 in nsINode::LastRelease() dom/base/nsINode.cpp:763:50
#4 0x7fe023e3813e in mozilla::dom::Document::Release() dom/base/Document.cpp:2518:1
#5 0x7fe023d79bae in nsNodeInfoManager::RemoveNodeInfo(mozilla::dom::NodeInfo*) dom/base/nsNodeInfoManager.cpp:330:20
#6 0x7fe024066e42 in mozilla::dom::NodeInfo::~NodeInfo() dom/base/NodeInfo.cpp:38:18
#7 0x7fe024068ea8 in mozilla::dom::NodeInfo::DeleteCycleCollectable() dom/base/NodeInfo.cpp:177:3
#8 0x7fe01f6545d4 in MaybeKillObject xpcom/base/nsCycleCollector.cpp:2632:29
#9 0x7fe01f6545d4 in SnowWhiteKiller::Visit(nsPurpleBuffer&, nsPurpleBufferEntry*) xpcom/base/nsCycleCollector.cpp:2657:9
#10 0x7fe01f640704 in void nsPurpleBuffer::VisitEntries<SnowWhiteKiller>(SnowWhiteKiller&) xpcom/base/nsCycleCollector.cpp:987:23
#11 0x7fe01f628b98 in nsCycleCollector::FreeSnowWhiteWithBudget(JS::SliceBudget&) xpcom/base/nsCycleCollector.cpp:2825:14
#12 0x7fe0213dfeed in AsyncFreeSnowWhite::Run() js/xpconnect/src/XPCJSRuntime.cpp:165:9
#13 0x7fe01f835ede in IdleRunnableWrapper::Run() xpcom/threads/nsThreadUtils.cpp:327:22
#14 0x7fe01f7de93a in mozilla::RunnableTask::Run() xpcom/threads/TaskController.cpp:714:16
#15 0x7fe01f7bf40d in mozilla::TaskController::RunTask(mozilla::Task*) xpcom/threads/TaskController.cpp:218:19
#16 0x7fe01f7c62c0 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) xpcom/threads/TaskController.cpp:1143:20
#17 0x7fe01f7c3f8b in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) xpcom/threads/TaskController.cpp:1008:15
#18 0x7fe01f7c42e6 in mozilla::TaskController::ProcessPendingMTTask(bool) xpcom/threads/TaskController.cpp:650:36
#19 0x7fe01f7cdba1 in operator() xpcom/threads/TaskController.cpp:351:37
#20 0x7fe01f7cdba1 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() xpcom/threads/nsThreadUtils.h:548:5
#21 0x7fe01f80e65f in nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:1159:16
#22 0x7fe01f818740 in NS_ProcessNextEvent(nsIThread*, bool) xpcom/threads/nsThreadUtils.cpp:480:10
#23 0x7fe0211172bf in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:85:21
#24 0x7fe020f61a64 in RunInternal ipc/chromium/src/base/message_loop.cc:369:10
#25 0x7fe020f61a64 in RunHandler ipc/chromium/src/base/message_loop.cc:362:3
#26 0x7fe020f61a64 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:344:3
#27 0x7fe02b778e6c in nsBaseAppShell::Run() widget/nsBaseAppShell.cpp:148:27
#28 0x7fe02b9719ab in nsAppShell::Run() widget/gtk/nsAppShell.cpp:470:33
#29 0x7fe02da0b355 in XRE_RunAppShell() toolkit/xre/nsEmbedFunctions.cpp:646:20
#30 0x7fe020f61a64 in RunInternal ipc/chromium/src/base/message_loop.cc:369:10
#31 0x7fe020f61a64 in RunHandler ipc/chromium/src/base/message_loop.cc:362:3
#32 0x7fe020f61a64 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:344:3
#33 0x7fe02da0a7bf in XRE_InitChildProcess(int, char**, XREChildData const*) toolkit/xre/nsEmbedFunctions.cpp:584:34
#34 0x557411194829 in main browser/app/nsBrowserApp.cpp:397:22
#35 0x7fe03e35ec89 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#36 0x7fe03e35ed44 in __libc_start_main csu/../csu/libc-start.c:360:3
#37 0x5574110b3ed8 in _start (objdir-ff-asan/dist/bin/firefox+0xcced8) (BuildId: 5096f3c0a5c762fcb7d6894b6b9d8d93)
0x511000078b90 is located 16 bytes inside of 208-byte region [0x511000078b80,0x511000078c50)
freed by thread T0 (Isolated Web Co) here:
#0 0x557411151536 in free /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3
#1 0x7fe01f641321 in MaybeKillObject xpcom/base/nsCycleCollector.cpp:2632:29
#2 0x7fe01f641321 in SnowWhiteKiller::~SnowWhiteKiller() xpcom/base/nsCycleCollector.cpp:2619:7
#3 0x7fe01f6283ef in nsCycleCollector::FreeSnowWhite(bool) xpcom/base/nsCycleCollector.cpp:2809:3
#4 0x7fe01f62f602 in nsCycleCollector::BeginCollection(mozilla::CCReason, ccIsManual, nsICycleCollectorListener*) xpcom/base/nsCycleCollector.cpp:3854:3
#5 0x7fe01f62e590 in nsCycleCollector::Collect(mozilla::CCReason, ccIsManual, JS::SliceBudget&, nsICycleCollectorListener*, bool) xpcom/base/nsCycleCollector.cpp:3650:9
#6 0x7fe01f632bb9 in nsCycleCollector_collect(mozilla::CCReason, nsICycleCollectorListener*) xpcom/base/nsCycleCollector.cpp:4199:28
#7 0x7fe0242f4073 in nsJSContext::CycleCollectNow(mozilla::CCReason, nsICycleCollectorListener*) dom/base/nsJSEnvironment.cpp:1110:3
#8 0x7fe026062b58 in mozilla::dom::FuzzingFunctions_Binding::cycleCollect(JSContext*, unsigned int, JS::Value*) objdir-ff-asan/dom/bindings/./FuzzingFunctionsBinding.cpp:133:3
#9 0x7fe02de0baff in CallJSNative js/src/vm/Interpreter.cpp:532:13
#10 0x7fe02de0baff in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) js/src/vm/Interpreter.cpp:628:12
#11 0x7fe02de25a37 in InternalCall js/src/vm/Interpreter.cpp:695:10
#12 0x7fe02de25a37 in CallFromStack js/src/vm/Interpreter.cpp:700:10
#13 0x7fe02de25a37 in js::Interpret(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:3338:16
#14 0x7fe02de0a94e in MaybeEnterInterpreterTrampoline js/src/vm/Interpreter.cpp:433:10
#15 0x7fe02de0a94e in js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:502:13
#16 0x7fe02de0f9c1 in ExecuteKernel js/src/vm/Interpreter.cpp:893:13
#17 0x7fe02de0f9c1 in js::Execute(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp:926:10
#18 0x7fe02df75d09 in ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) js/src/vm/CompilationAndEvaluation.cpp:601:10
#19 0x7fe02df75f80 in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) js/src/vm/CompilationAndEvaluation.cpp:625:10
#20 0x7fe02b286527 in ExecuteCompiledScript dom/script/ScriptLoader.cpp:2664:8
#21 0x7fe02b286527 in mozilla::dom::ScriptLoader::EvaluateScript(nsIGlobalObject*, JS::loader::ScriptLoadRequest*) dom/script/ScriptLoader.cpp:3148:7
#22 0x7fe02b285268 in mozilla::dom::ScriptLoader::EvaluateScriptElement(JS::loader::ScriptLoadRequest*) dom/script/ScriptLoader.cpp:2733:10
#23 0x7fe02b27dfb4 in mozilla::dom::ScriptLoader::ProcessRequest(JS::loader::ScriptLoadRequest*) dom/script/ScriptLoader.cpp:2365:10
#24 0x7fe02b27ae93 in mozilla::dom::ScriptLoader::ProcessInlineScript(nsIScriptElement*, JS::loader::ScriptKind) dom/script/ScriptLoader.cpp:1616:10
#25 0x7fe02b262de0 in mozilla::dom::ScriptLoader::ProcessScriptElement(nsIScriptElement*) dom/script/ScriptLoader.cpp:1212:10
#26 0x7fe02b2626f2 in mozilla::dom::ScriptElement::MaybeProcessScript() dom/script/ScriptElement.cpp:210:18
#27 0x7fe02196ac86 in AttemptToExecute objdir-ff-asan/dist/include/nsIScriptElement.h:224:18
#28 0x7fe02196ac86 in nsHtml5TreeOpExecutor::RunScript(nsIContent*, bool) parser/html/nsHtml5TreeOpExecutor.cpp:915:22
#29 0x7fe02196673b in nsHtml5TreeOpExecutor::RunFlushLoop() parser/html/nsHtml5TreeOpExecutor.cpp:694:7
#30 0x7fe0219a965b in nsHtml5ExecutorFlusher::Run() parser/html/nsHtml5StreamParser.cpp:161:18
#31 0x7fe01f7de93a in mozilla::RunnableTask::Run() xpcom/threads/TaskController.cpp:714:16
#32 0x7fe01f7bf40d in mozilla::TaskController::RunTask(mozilla::Task*) xpcom/threads/TaskController.cpp:218:19
#33 0x7fe01f7c62c0 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) xpcom/threads/TaskController.cpp:1143:20
#34 0x7fe01f7c3cc8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) xpcom/threads/TaskController.cpp:966:15
#35 0x7fe01f7c42e6 in mozilla::TaskController::ProcessPendingMTTask(bool) xpcom/threads/TaskController.cpp:650:36
#36 0x7fe01f7cdba1 in operator() xpcom/threads/TaskController.cpp:351:37
#37 0x7fe01f7cdba1 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() xpcom/threads/nsThreadUtils.h:548:5
#38 0x7fe01f80e65f in nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:1159:16
previously allocated by thread T0 (Isolated Web Co) here:
#0 0x5574111517cf in malloc /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:68:3
#1 0x55741119854d in moz_xmalloc memory/mozalloc/mozalloc.cpp:52:15
#2 0x7fe02b021367 in operator new objdir-ff-asan/dist/include/mozilla/cxxalloc.h:33:10
#3 0x7fe02b021367 in txMozillaXSLTProcessor::Constructor(mozilla::dom::GlobalObject const&) dom/xslt/xslt/txMozillaXSLTProcessor.cpp:1122:7
#4 0x7fe025a17c78 in mozilla::dom::XSLTProcessor_Binding::_constructor(JSContext*, unsigned int, JS::Value*) objdir-ff-asan/dom/bindings/./XSLTProcessorBinding.cpp:1596:54
#5 0x7fe02de0deb8 in CallJSNative js/src/vm/Interpreter.cpp:532:13
#6 0x7fe02de0deb8 in CallJSNativeConstructor js/src/vm/Interpreter.cpp:550:8
#7 0x7fe02de0deb8 in InternalConstruct(JSContext*, js::AnyConstructArgs const&, js::CallReason) js/src/vm/Interpreter.cpp:756:14
#8 0x7fe02de259f1 in ConstructFromStack js/src/vm/Interpreter.cpp:803:10
#9 0x7fe02de259f1 in js::Interpret(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:3323:16
#10 0x7fe02de0a94e in MaybeEnterInterpreterTrampoline js/src/vm/Interpreter.cpp:433:10
#11 0x7fe02de0a94e in js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:502:13
#12 0x7fe02de0f9c1 in ExecuteKernel js/src/vm/Interpreter.cpp:893:13
#13 0x7fe02de0f9c1 in js::Execute(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp:926:10
#14 0x7fe02df75d09 in ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) js/src/vm/CompilationAndEvaluation.cpp:601:10
#15 0x7fe02df75f80 in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) js/src/vm/CompilationAndEvaluation.cpp:625:10
#16 0x7fe02b286527 in ExecuteCompiledScript dom/script/ScriptLoader.cpp:2664:8
#17 0x7fe02b286527 in mozilla::dom::ScriptLoader::EvaluateScript(nsIGlobalObject*, JS::loader::ScriptLoadRequest*) dom/script/ScriptLoader.cpp:3148:7
#18 0x7fe02b285268 in mozilla::dom::ScriptLoader::EvaluateScriptElement(JS::loader::ScriptLoadRequest*) dom/script/ScriptLoader.cpp:2733:10
#19 0x7fe02b27dfb4 in mozilla::dom::ScriptLoader::ProcessRequest(JS::loader::ScriptLoadRequest*) dom/script/ScriptLoader.cpp:2365:10
#20 0x7fe02b27ae93 in mozilla::dom::ScriptLoader::ProcessInlineScript(nsIScriptElement*, JS::loader::ScriptKind) dom/script/ScriptLoader.cpp:1616:10
#21 0x7fe02b262de0 in mozilla::dom::ScriptLoader::ProcessScriptElement(nsIScriptElement*) dom/script/ScriptLoader.cpp:1212:10
#22 0x7fe02b2626f2 in mozilla::dom::ScriptElement::MaybeProcessScript() dom/script/ScriptElement.cpp:210:18
#23 0x7fe02196ac86 in AttemptToExecute objdir-ff-asan/dist/include/nsIScriptElement.h:224:18
#24 0x7fe02196ac86 in nsHtml5TreeOpExecutor::RunScript(nsIContent*, bool) parser/html/nsHtml5TreeOpExecutor.cpp:915:22
#25 0x7fe02196673b in nsHtml5TreeOpExecutor::RunFlushLoop() parser/html/nsHtml5TreeOpExecutor.cpp:694:7
#26 0x7fe0219a965b in nsHtml5ExecutorFlusher::Run() parser/html/nsHtml5StreamParser.cpp:161:18
#27 0x7fe01f7de93a in mozilla::RunnableTask::Run() xpcom/threads/TaskController.cpp:714:16
#28 0x7fe01f7bf40d in mozilla::TaskController::RunTask(mozilla::Task*) xpcom/threads/TaskController.cpp:218:19
#29 0x7fe01f7c62c0 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) xpcom/threads/TaskController.cpp:1143:20
#30 0x7fe01f7c3cc8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) xpcom/threads/TaskController.cpp:966:15
#31 0x7fe01f7c42e6 in mozilla::TaskController::ProcessPendingMTTask(bool) xpcom/threads/TaskController.cpp:650:36
#32 0x7fe01f7cdba1 in operator() xpcom/threads/TaskController.cpp:351:37
#33 0x7fe01f7cdba1 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() xpcom/threads/nsThreadUtils.h:548:5
#34 0x7fe01f80e65f in nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:1159:16
#35 0x7fe01f818740 in NS_ProcessNextEvent(nsIThread*, bool) xpcom/threads/nsThreadUtils.cpp:480:10
#36 0x7fe0211172bf in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:85:21
#37 0x7fe020f61a64 in RunInternal ipc/chromium/src/base/message_loop.cc:369:10
#38 0x7fe020f61a64 in RunHandler ipc/chromium/src/base/message_loop.cc:362:3
#39 0x7fe020f61a64 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:344:3
#40 0x7fe02b778e6c in nsBaseAppShell::Run() widget/nsBaseAppShell.cpp:148:27
SUMMARY: AddressSanitizer: heap-use-after-free objdir-ff-asan/dist/include/mozilla/DoublyLinkedList.h:152:58 in operator++
Shadow bytes around the buggy address:
0x511000078900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x511000078980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x511000078a00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x511000078a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x511000078b00: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa
=>0x511000078b80: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
0x511000078c00: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
0x511000078c80: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x511000078d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x511000078d80: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa
0x511000078e00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==1870935==ABORTING
|
|
Assignee | |
Comment 22•1 year ago
|
||
Well, the fact is that D234845 is not preventing all JS from running during the transform, and it is hard to prevent that. Relying on that patch isn't a fix, since it's trivially circumvented.
Preventing modification of the XSLTProcessor during a transform would be the best fix for these other issues.
|
|
Reporter | |
Comment 23•1 year ago
|
||
I'm not sure even preventing the modification of XSLTProcessor would be sufficient to prevent all instances (I'm not sure, but in the params.py variant it might be sufficient to just modify the param node and not touch the XSLTProcessor).
Perhaps the best fix is to deprecate XSLTProcessor entirely (I will be making the same suggestion to Chrome as well).
|
|
Assignee | |
Comment 24•1 year ago
|
||
Deprecating doesn't help fix the security issues, it'll take time (we already looked at usage counters and iirc it seemed too high to just turn it off).
|
|
Assignee | |
Comment 25•1 year ago
|
||
|
|
Assignee | |
Comment 26•1 year ago
|
||
|
|
Assignee | |
Comment 27•1 year ago
|
||
Comment on attachment 9464745 [details]
Bug 1941002 - Check state before compiling/transforming. r?smaug!
Security Approval Request
- How easily could an exploit be constructed based on the patch?: Not super obvious. It's adding strong references, but no obvious references how one can run script while the raw pointers were on the stack.
- Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
- Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: All
- If not all supported branches, which bug introduced the flaw?: None
- Do you have backports for the affected branches?: No
- If not, how different, hard to create, and risky will they be?: Should be trivial.
- How likely is this patch to cause regressions; how much testing does it need?: Might have small performance regression when using XSLT transforms through the DOM API. Also slight behaviour change when using the API, but in an extremely unlikely edge case that wouldn't be supported by other browsers. Should be very rare.
- Is the patch ready to land after security approval is given?: Yes
- Is Android affected?: Yes
Flags: needinfo?(peterv)
Attachment #9464745 -
Flags: sec-approval?
|
|
Assignee | |
Comment 28•1 year ago
|
||
I decided to ask for security approval again, for D237259 and D237260, which fix additional issues on top of the ones fixed by D235577 (which got security approval before and already landed on trunk).
If there are more issues found I really would like to track them in separate bugs. It makes it much easier to track the landing of fixes, potential backouts and dependencies between bugs.
|
|
Assignee | |
Updated•1 year ago
|
Attachment #9460505 -
Attachment is obsolete: true
|
|
Assignee | |
Updated•1 year ago
|
Attachment #9460506 -
Attachment is obsolete: true
|
|
||
Comment 29•1 year ago
|
||
Comment on attachment 9464745 [details]
Bug 1941002 - Check state before compiling/transforming. r?smaug!
Approved to land and request uplift
Attachment #9464745 -
Flags: sec-approval? → sec-approval+
Attachment #9464744 -
Flags: sec-approval+
|
|
||
Comment 30•1 year ago
|
||
Comment on attachment 9464744 [details]
Bug 1941002 - Make XPath tree walker hold a strong reference. r?smaug!
Approved to land and request uplift
|
|
||
Comment 31•1 year ago
|
||
Pushed by pvanderbeken@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/11968b6c8b3f
Make XPath tree walker hold a strong reference. r=smaug
https://hg.mozilla.org/integration/autoland/rev/e22cf499b2e3
Check state before compiling/transforming. r=smaug
|
|
||
Comment 32•1 year ago
|
||
Backed out for causing build bustages in txMozillaXSLTProcessor.cpp:
https://hg.mozilla.org/integration/autoland/rev/b361f91a8ce56a6c6f51f2d445486589de712e89
Push with failures
Failure log
ERROR - /builds/worker/checkouts/gecko/dom/xslt/xslt/txMozillaXSLTProcessor.cpp:268:14: error: too few arguments to function call, single argument 'aError' was not specified
Flags: needinfo?(peterv)
|
|
||
Comment 33•1 year ago
|
||
Pushed by pvanderbeken@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/0aed6fc42eb3
Make XPath tree walker hold a strong reference. r=smaug
https://hg.mozilla.org/integration/autoland/rev/57759a2ddebc
Check state before compiling/transforming. r=smaug
|
|
Assignee | |
Updated•1 year ago
|
Flags: needinfo?(peterv)
|
|
||
Comment 34•1 year ago
|
||
:peterv the last beta for the Fx136 has already been built.
Could you add beta and esr uplift requests on this now? So we're not blocked and I can take them before RC builds
Flags: needinfo?(peterv)
|
|
||
Comment 35•1 year ago
|
||
Backed out
https://hg.mozilla.org/integration/autoland/rev/b97e12ebadcde95f22b9c9553e89226a9ade35e3
[task 2025-02-21T15:48:34.043Z] 15:48:34 INFO - GECKO(1995) | [3466] Assertion failure: mRawPtr != nullptr (You can't dereference a NULL nsCOMPtr with operator->().), at /builds/worker/workspace/obj-build/dist/include/nsCOMPtr.h:771
[task 2025-02-21T15:48:34.061Z] 15:48:34 INFO - Initializing stack-fixing for the first stack frame, this may take a while...
[task 2025-02-21T15:48:50.088Z] 15:48:50 INFO - GECKO(1995) | #01: LocationStep::evaluate(txIEvalContext*, txAExprResult**) [dom/xslt/xpath/txLocationStep.cpp:167]
[task 2025-02-21T15:48:50.088Z] 15:48:50 INFO - GECKO(1995) | #02: PathExpr::evaluate(txIEvalContext*, txAExprResult**) [dom/xslt/xpath/txPathExpr.cpp:85]
[task 2025-02-21T15:48:50.089Z] 15:48:50 INFO - GECKO(1995) | #03: mozilla::dom::XPathExpression::EvaluateWithContext(nsINode&, unsigned int, unsigned int, unsigned short, mozilla::dom::XPathResult*, mozilla::ErrorResult&) [dom/xslt/xpath/XPathExpression.cpp:134]
[task 2025-02-21T15:48:50.090Z] 15:48:50 INFO - GECKO(1995) | #04: FindNodeByXPath(mozilla::dom::Document&, nsTSubstring<char16_t> const&) [toolkit/components/sessionstore/SessionStoreUtils.cpp:1351]
[task 2025-02-21T15:48:50.090Z] 15:48:50 INFO - GECKO(1995) | #05: mozilla::dom::SessionStoreUtils::RestoreFormData(mozilla::dom::Document&, nsTString<char16_t> const&, nsTArray<mozilla::dom::SessionStoreRestoreData::Entry> const&) [toolkit/components/sessionstore/SessionStoreUtils.cpp:0]
[task 2025-02-21T15:48:50.091Z] 15:48:50 INFO - GECKO(1995) | #06: mozilla::dom::SessionStoreRestoreData::RestoreInto(RefPtr<mozilla::dom::BrowsingContext>) [toolkit/components/sessionstore/SessionStoreRestoreData.cpp:73]
[task 2025-02-21T15:48:50.091Z] 15:48:50 INFO - GECKO(1995) | #07: mozilla::dom::WindowGlobalChild::RecvRestoreTabContent(mozilla::dom::SessionStoreRestoreData*, std::function<void (bool const&)>&&) [dom/ipc/WindowGlobalChild.cpp:530]
[task 2025-02-21T15:48:50.092Z] 15:48:50 INFO - GECKO(1995) | #08: mozilla::dom::PWindowGlobalChild::OnMessageReceived(IPC::Message const&) [s3:gecko-generated-sources:639092137b07a27f0c8beba7f9364868ef8c161dad61ff30f4beccea782a55a9f3de1ef8634b57598f8ca6bbf6f73fa8c315ad129b46997f63f08271711d81e1/ipc/ipdl/PWindowGlobalChild.cpp::2042]
[task 2025-02-21T15:48:50.093Z] 15:48:50 INFO - GECKO(1995) | #09: mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) [s3:gecko-generated-sources:420d21f26be92dd429207d02877e01ca29a0c85c0d3e87cc285be5c5025958eebf1e2ce86bb3298949865b9eb71d8330e83ea468fdfb2d361f2f724c778ca8c0/ipc/ipdl/PContentChild.cpp::8836]
[task 2025-02-21T15:48:50.093Z] 15:48:50 INFO - GECKO(1995) | #10: mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) [ipc/glue/MessageChannel.cpp:1789]
[task 2025-02-21T15:48:50.097Z] 15:48:50 INFO - GECKO(1995) | #11: mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message> >) [ipc/glue/MessageChannel.cpp:0]
[task 2025-02-21T15:48:50.097Z] 15:48:50 INFO - GECKO(1995) | #12: mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) [ipc/glue/MessageChannel.cpp:1507]
[task 2025-02-21T15:48:50.097Z] 15:48:50 INFO - GECKO(1995) | #13: mozilla::ipc::MessageChannel::MessageTask::Run() [ipc/glue/MessageChannel.cpp:1616]
[task 2025-02-21T15:48:50.098Z] 15:48:50 INFO - GECKO(1995) | #14: mozilla::RunnableTask::Run() [xpcom/threads/TaskController.cpp:704]
[task 2025-02-21T15:48:50.098Z] 15:48:50 INFO - GECKO(1995) | #15: mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) [xpcom/threads/TaskController.cpp:1250]
[task 2025-02-21T15:48:50.098Z] 15:48:50 INFO - GECKO(1995) | #16: mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) [xpcom/threads/TaskController.cpp:0]
[task 2025-02-21T15:48:50.099Z] 15:48:50 INFO - GECKO(1995) | #17: mozilla::TaskController::ProcessPendingMTTask(bool) [xpcom/threads/TaskController.cpp:639]
[task 2025-02-21T15:48:50.099Z] 15:48:50 INFO - GECKO(1995) | #18: mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() [xpcom/threads/nsThreadUtils.h:549]
[task 2025-02-21T15:48:50.100Z] 15:48:50 INFO - GECKO(1995) | #19: nsThread::ProcessNextEvent(bool, bool*) [xpcom/threads/nsThread.cpp:1163]
[task 2025-02-21T15:48:50.101Z] 15:48:50 INFO - GECKO(1995) | #20: NS_ProcessNextEvent(nsIThread*, bool) [xpcom/threads/nsThreadUtils.cpp:480]
[task 2025-02-21T15:48:50.101Z] 15:48:50 INFO - GECKO(1995) | #21: mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) [ipc/glue/MessagePump.cpp:86]
[task 2025-02-21T15:48:50.102Z] 15:48:50 INFO - GECKO(1995) | #22: MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:345]
[task 2025-02-21T15:48:50.102Z] 15:48:50 INFO - GECKO(1995) | #23: nsBaseAppShell::Run() [widget/nsBaseAppShell.cpp:150]
[task 2025-02-21T15:48:50.102Z] 15:48:50 INFO - GECKO(1995) | #24: nsAppShell::Run() [widget/gtk/nsAppShell.cpp:470]
[task 2025-02-21T15:48:50.103Z] 15:48:50 INFO - GECKO(1995) | #25: XRE_RunAppShell() [toolkit/xre/nsEmbedFunctions.cpp:646]
[task 2025-02-21T15:48:50.103Z] 15:48:50 INFO - GECKO(1995) | #26: mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) [ipc/glue/MessagePump.cpp:235]
[task 2025-02-21T15:48:50.103Z] 15:48:50 INFO - GECKO(1995) | #27: MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:345]
[task 2025-02-21T15:48:50.103Z] 15:48:50 INFO - GECKO(1995) | #28: XRE_InitChildProcess(int, char**, XREChildData const*) [toolkit/xre/nsEmbedFunctions.cpp:588]
[task 2025-02-21T15:48:50.146Z] 15:48:50 INFO - GECKO(1995) | #29: main [browser/app/nsBrowserApp.cpp:404]
[task 2025-02-21T15:48:50.148Z] 15:48:50 INFO - GECKO(1995) | #30: __libc_start_main [/lib/x86_64-linux-gnu/libc.so.6 + 0x21b97]
[task 2025-02-21T15:48:50.149Z] 15:48:50 INFO - GECKO(1995) | #31: ??? [/builds/worker/workspace/build/application/firefox/firefox-bin + 0x40d89]
[task 2025-02-21T15:48:50.149Z] 15:48:50 INFO - GECKO(1995) | #32: ??? (???:???)
REFTEST ERROR | TEST-UNEXPECTED-FAIL | layout/reftests/bugs/232990-1a.xhtml == layout/reftests/bugs/232990-1-ref.xhtml | application timed out after 370 seconds with no output
|
|
||
Comment 36•1 year ago
|
||
Pushed by pvanderbeken@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/b4ac9b14a9e9
Make XPath tree walker hold a strong reference. r=smaug
https://hg.mozilla.org/integration/autoland/rev/0bc2dc3eca75
Check state before compiling/transforming. r=smaug
|
|
||
Updated•1 year ago
|
|
|
||
Comment 37•1 year ago
|
||
https://hg.mozilla.org/mozilla-central/rev/b4ac9b14a9e9
https://hg.mozilla.org/mozilla-central/rev/0bc2dc3eca75
Status: REOPENED → RESOLVED
Closed: 1 year ago → 1 year ago
Flags: needinfo?(peterv)
Resolution: --- → FIXED
Target Milestone: --- → 137 Branch
|
|
||
Updated•1 year ago
|
Flags: needinfo?(peterv)
|
|
Assignee | |
Comment 38•1 year ago
|
||
Comment on attachment 9461852 [details]
Bug 1941002 - Clone source. r?smaug!
Beta/Release Uplift Approval Request
- User impact if declined/Reason for urgency: sec-high
- Is this code covered by automated tests?: Yes
- Has the fix been verified in Nightly?: Yes
- Needs manual test from QE?: No
- If yes, steps to reproduce:
- List of other uplifts needed: None
- Risk to taking this patch: Low
- Why is the change risky/not risky? (and alternatives if risky): Mostly just changes to using strong pointers, and avoids reentering code that wasn't meant to be reentered by throwing instead. Might have small performance regression when using XSLT transforms through the DOM API. Also slight behaviour change when using the API, but in an extremely unlikely edge case that wouldn't be supported by other browsers. Should be very rare.
- String changes made/needed: None
- Is Android affected?: Yes
Flags: needinfo?(peterv)
Attachment #9461852 -
Flags: approval-mozilla-beta?
|
|
||
Comment 39•1 year ago
|
||
Comment on attachment 9461852 [details]
Bug 1941002 - Clone source. r?smaug!
This landed too late to take for Fx136.
Changing beta requests to esr requests since it's needed there for the Fx137 release timeline
Attachment #9461852 -
Flags: approval-mozilla-esr128?
Attachment #9461852 -
Flags: approval-mozilla-esr115?
Attachment #9461852 -
Flags: approval-mozilla-beta?
|
||
Updated•1 year ago
|
QA Whiteboard: [post-critsmash-triage]
Flags: qe-verify-
|
|
||
Updated•1 year ago
|
Attachment #9464744 -
Flags: approval-mozilla-esr128?
Attachment #9464744 -
Flags: approval-mozilla-esr115?
Attachment #9464745 -
Flags: approval-mozilla-esr128?
Attachment #9464745 -
Flags: approval-mozilla-esr115?
|
||
Updated•1 year ago
|
Attachment #9461852 -
Flags: approval-mozilla-esr128? → approval-mozilla-esr128+
|
|
||
Updated•1 year ago
|
Attachment #9464744 -
Flags: approval-mozilla-esr128? → approval-mozilla-esr128+
|
|
||
Updated•1 year ago
|
Attachment #9464745 -
Flags: approval-mozilla-esr128? → approval-mozilla-esr128+
|
|
||
Comment 40•1 year ago
|
||
| uplift | ||
|
|
||
Updated•1 year ago
|
|
|
||
Updated•1 year ago
|
Attachment #9464744 -
Flags: approval-mozilla-esr115? → approval-mozilla-esr115+
|
|
||
Updated•1 year ago
|
Attachment #9461852 -
Flags: approval-mozilla-esr115? → approval-mozilla-esr115+
|
|
||
Updated•1 year ago
|
Attachment #9464745 -
Flags: approval-mozilla-esr115? → approval-mozilla-esr115+
|
|
||
Comment 41•1 year ago
|
||
| uplift | ||
|
|
||
Updated•1 year ago
|
|
||
Comment 42•1 year ago
|
||
|
|
||
Updated•1 year ago
|
Whiteboard: [disclosure deadline 2025-04-10][reminder-test 2025-04-15] → [disclosure deadline 2025-04-10][reminder-test 2025-04-15][adv-main137+]
|
|
||
Updated•1 year ago
|
Whiteboard: [disclosure deadline 2025-04-10][reminder-test 2025-04-15][adv-main137+] → [disclosure deadline 2025-04-10][reminder-test 2025-04-15][adv-main137+][adv-ESR115.22+][adv-ESR128.9+]
|
|
||
Updated•1 year ago
|
Whiteboard: [disclosure deadline 2025-04-10][reminder-test 2025-04-15][adv-main137+][adv-ESR115.22+][adv-ESR128.9+] → [disclosure deadline 2025-04-10][reminder-test 2025-04-15][adv-main137+][adv-esr115.22+][adv-esr128.9+]
|
||
Updated•1 year ago
|
Alias: CVE-2025-3028
|
||
Updated•1 year ago
|
status-firefox138:
--- → fixed
|
|
||
Comment 43•1 year ago
|
||
2 months ago, tjr placed a reminder on the bug using the whiteboard tag [reminder-test 2025-04-15] .
peterv, please refer to the original comment to better understand the reason for the reminder.
Flags: needinfo?(peterv)
Whiteboard: [disclosure deadline 2025-04-10][reminder-test 2025-04-15][adv-main137+][adv-esr115.22+][adv-esr128.9+] → [disclosure deadline 2025-04-10][adv-main137+][adv-esr115.22+][adv-esr128.9+]
|
|
||
Updated•1 year ago
|
Flags: needinfo?(peterv) → needinfo?(smaug)
|
|
||
Updated•1 year ago
|
Group: core-security-release
|
|
||
Comment 44•1 year ago
|
||
|
|
||
Comment 45•1 year ago
|
||
| bugherder | ||
|
|
||
Updated•1 year ago
|
Flags: needinfo?(smaug)
|
|
||
Updated•1 year ago
|
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•