1949145 - Memory leak in nss_cms_before_data

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P1)

Description

[Maurice Dauer [:mdauer]]

Attachment: clusterfuzz-testcase-smime-5675185185554432

OSS-Fuzz: https://oss-fuzz.com/testcase-detail/5675185185554432

Details

The NSSCMSDecoderContext allocated in nss_cms_before_data is never free'd:

    childp7dcx = PORT_ZNew(NSSCMSDecoderContext);

---

To reproduce, perform the following steps:

1. Build NSS with ./build.sh -c --fuzz --disable-tests
2. Run /path/to/dist/Debug/bin/nssfuzz-smime /path/to/testcase

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:beurdouche, could you have a look please?

For more information, please visit BugBot documentation.

Comment 2

[Maurice Dauer [:mdauer]]

Just sharing what I found since I spent quite some time looking into this, but couldn't find a fix:
So, the allocated childp7dxc should in theory get free'd again in nss_cms_after_data here. nss_cms_after_data is called by nss_cms_decoder_notify here and is the notify callback for the ASN1 decoder. My guess would be that we reach a state in the ASN1 decoder where sec_asn1d_notify_after should be called, but isn't. I think the last state->place was duringSequence. Setting DEBUG_ASN1D_STATE was quite useful, though you may need to remove the state->place >= 0 checks to get it to compile.

Comment 3

[Maurice Dauer [:mdauer]]

Attachment: clusterfuzz-testcase-minimized-smime-5675185185554432

Attaching the minimized testcase from OSS-Fuzz

Comment 4

[Dennis Jackson]

Attachment: Bug 1949145 - Allocate child CMS decoders via arena. r=#nss-reviewers

Comment 5

[Dennis Jackson]

Attachment: Bug 1949145 - Handle invalid CMS ContentInfo gracefully. r=#nss-reviewers

Comment 6

[Dennis Jackson]

Attachment: Bug 1949145 - Clean up how CMSDecoder is torn down. r=#nss-reviewers

Comment 7

[Dennis Jackson]

Attachment: Bug 1949145 - Make sure content is cleaned up when tearing down CMSDecoder. r=#nss-reviewers

Comment 8

[Dennis Jackson]

https://hg-edge.mozilla.org/projects/nss/rev/b8b8f1cf7caa1e457b226f6e1bdcc3a2b2978e69
https://hg-edge.mozilla.org/projects/nss/rev/b4e99b13cbb6219a84dce0903a0063f94dc55c79
https://hg-edge.mozilla.org/projects/nss/rev/5ab653677c69a813e304220597422654fec05e38