1983288 - AddressSanitizer: heap-use-after-free [@ mozilla::MediaTrackGraphImpl::GetInstance] with READ of size 4

Status: RESOLVED DUPLICATE of bug 1988931

(Core :: Audio/Video, defect, P2)

Description

[Jason Kratzer [:jkratzer]]

Found while fuzzing mozilla-central rev 76f448acb1d5 (built with: --enable-address-sanitizer --enable-fuzzing).

I don't currently have a reproducible testcase.

AddressSanitizer: heap-use-after-free [@ mozilla::MediaTrackGraphImpl::GetInstance] with READ of size 4

    =================================================================
    ==928==ERROR: AddressSanitizer: heap-use-after-free on address 0x11946bd0652c at pc 0x7ffae5f32841 bp 0x0054b53fbf80 sp 0x0054b53fbfc8
    READ of size 4 at 0x11946bd0652c thread T0
        #0 0x7ffae5f32840 in mozilla::MediaTrackGraphImpl::GetInstance /dom/media/MediaTrackGraph.cpp:3591
        #1 0x7ffae5f3d568 in mozilla::MediaTrackGraph::GetInstance /dom/media/MediaTrackGraph.cpp:3608
        #2 0x7ffae6a45eff in mozilla::dom::AudioDestinationNode::AudioDestinationNode /dom/media/webaudio/AudioDestinationNode.cpp:304
        #3 0x7ffae6a45607 in mozilla::dom::AudioContext::AudioContext /dom/media/webaudio/AudioContext.cpp:182
        #4 0x7ffae6a487fa in mozilla::dom::AudioContext::Constructor /dom/media/webaudio/AudioContext.cpp:285
        #5 0x7ffae2abb837 in mozilla::dom::AudioContext_Binding::_constructor /builds/worker/workspace/obj-build/dom/bindings/./AudioContextBinding.cpp:785
        #6 0x7ffaee12f6c8 in InternalConstruct /js/src/vm/Interpreter.cpp:725
        #7 0x7ffaeeb8b10c in js::jit::DoCallFallback /js/src/jit/BaselineIC.cpp:1684
        #8 0x000fa98a3af1  (<unknown module>)
    
    0x11946bd0652c is located 12 bytes inside of 96-byte region [0x11946bd06520,0x11946bd06580)
    freed by thread T0 here:
        #0 0x7ffb013aabad in free /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_win.cpp:82
        #1 0x7ffae5f8b218 in mozilla::detail::HashTable<mozilla::MediaTrackGraphImpl *const,mozilla::HashSet<mozilla::MediaTrackGraphImpl *,mozilla::(anonymous namespace)::GraphHasher,InfallibleAllocPolicy>::SetHashPolicy,InfallibleAllocPolicy>::changeTableSize /builds/worker/workspace/obj-build/dist/include/mozilla/HashTable.h:1916
        #2 0x7ffae5f2f698 in mozilla::MediaTrackGraphImpl::RemoveTrack /dom/media/MediaTrackGraph.cpp:3853
        #3 0x7ffae5f2ebf4 in mozilla::MediaTrack::Destroy /dom/media/MediaTrackGraph.cpp:2379
        #4 0x7ffae6a3eed5 in mozilla::dom::AudioNode::DestroyMediaTrack /dom/media/webaudio/AudioNode.cpp:573
        #5 0x7ffae6a5bbe4 in mozilla::dom::AudioNode::DisconnectFromGraph /dom/media/webaudio/AudioNode.cpp:181
        #6 0x7ffae6a3b9e6 in mozilla::dom::AudioNode::cycleCollection::Unlink /dom/media/webaudio/AudioNode.cpp:24
        #7 0x7ffae6a55ce5 in mozilla::dom::AudioDestinationNode::cycleCollection::Unlink /dom/media/webaudio/AudioDestinationNode.cpp:274
        #8 0x7ffade64431b in nsCycleCollector::CollectWhite /xpcom/base/nsCycleCollector.cpp:3288
        #9 0x7ffade648fc4 in nsCycleCollector::Collect /xpcom/base/nsCycleCollector.cpp:3700
        #10 0x7ffade65020c in nsCycleCollector_prepareForGarbageCollection /xpcom/base/nsCycleCollector.cpp:4264
        #11 0x7ffade5e2133 in mozilla::CycleCollectedJSRuntime::OnGC /xpcom/base/CycleCollectedJSRuntime.cpp:2091
        #12 0x7ffaeba79a1d in js::gc::GCRuntime::maybeCallGCCallback /js/src/gc/GC.cpp:4503
        #13 0x7ffaeba79f62 in js::gc::GCRuntime::gcCycle /js/src/gc/GC.cpp:4551
        #14 0x7ffaeba7bfed in js::gc::GCRuntime::collect /js/src/gc/GC.cpp:4788
        #15 0x7ffaeba7f6a9 in js::gc::GCRuntime::runDebugGC /js/src/gc/GC.cpp:5291
        #16 0x7ffaebaf3eb3 in js::gc::CellAllocator::AllocNurseryOrTenuredCell<0,1> /js/src/gc/Allocator-inl.h:194
        #17 0x7ffaebfe162b in js::NativeObject::create /js/src/vm/NativeObject-inl.h:482
        #18 0x7ffaec418756 in js::CallObject::createForFrame /js/src/vm/EnvironmentObject.cpp:156
        #19 0x7ffaec43fe58 in js::InitFunctionEnvironmentObjects /js/src/vm/EnvironmentObject.cpp:4224
        #20 0x000fa98a51be  (<unknown module>)
    
    previously allocated by thread T0 here:
        #0 0x7ffb013aacbd in malloc /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_win.cpp:98
        #1 0x7ffb25e6115d in moz_xmalloc /memory/mozalloc/mozalloc.cpp:52
        #2 0x7ffae5f8acf5 in mozilla::detail::HashTable<mozilla::MediaTrackGraphImpl *const,mozilla::HashSet<mozilla::MediaTrackGraphImpl *,mozilla::(anonymous namespace)::GraphHasher,InfallibleAllocPolicy>::SetHashPolicy,InfallibleAllocPolicy>::changeTableSize /builds/worker/workspace/obj-build/dist/include/mozilla/HashTable.h:1893
        #3 0x7ffae5f32362 in mozilla::MediaTrackGraphImpl::GetInstance /dom/media/MediaTrackGraph.cpp:3591
        #4 0x7ffae5f3d568 in mozilla::MediaTrackGraph::GetInstance /dom/media/MediaTrackGraph.cpp:3608
        #5 0x7ffae6a45eff in mozilla::dom::AudioDestinationNode::AudioDestinationNode /dom/media/webaudio/AudioDestinationNode.cpp:304
        #6 0x7ffae6a45607 in mozilla::dom::AudioContext::AudioContext /dom/media/webaudio/AudioContext.cpp:182
        #7 0x7ffae6a487fa in mozilla::dom::AudioContext::Constructor /dom/media/webaudio/AudioContext.cpp:285
        #8 0x7ffae2abb837 in mozilla::dom::AudioContext_Binding::_constructor /builds/worker/workspace/obj-build/dom/bindings/./AudioContextBinding.cpp:785
        #9 0x7ffaee12f6c8 in InternalConstruct /js/src/vm/Interpreter.cpp:725
        #10 0x7ffaee1468b3 in js::Interpret /js/src/vm/Interpreter.cpp:3272
        #11 0x7ffaee12c13e in js::RunScript /js/src/vm/Interpreter.cpp:471
        #12 0x7ffaee12d479 in js::InternalCallOrConstruct /js/src/vm/Interpreter.cpp:629
        #13 0x7ffaee12ec54 in js::Call /js/src/vm/Interpreter.cpp:696
        #14 0x7ffaec0e5235 in js::CallSelfHostedFunction /js/src/vm/SelfHosting.cpp:1211
        #15 0x7ffaef7c8bff in js::jit::InterpretResume /js/src/jit/VMFunctions.cpp:1138
        #16 0x000fa98a5372  (<unknown module>)
    
    SUMMARY: AddressSanitizer: heap-use-after-free /dom/media/MediaTrackGraph.cpp:3591 in mozilla::MediaTrackGraphImpl::GetInstance
    Shadow bytes around the buggy address:
      0x11946bd06280: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
      0x11946bd06300: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
      0x11946bd06380: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
      0x11946bd06400: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
      0x11946bd06480: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
    =>0x11946bd06500: fa fa fa fa fd[fd]fd fd fd fd fd fd fd fd fd fd
      0x11946bd06580: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
      0x11946bd06600: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 07 fa
      0x11946bd06680: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
      0x11946bd06700: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
      0x11946bd06780: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
    ==928==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Detailed Crash Information

Comment 2

[Daniel Veditz [:dveditz]]

Everything involved in the detected line is a pointer (which would be dangerous). Where is the "size 4" coming from? is it maybe some safer kind of data to be missing? But the free stack says it's the whole track so it does sound like a dangerous pointer UAF.

Comment 3

[Karl Tomlinson (:karlt)]

READ of size 4 at MediaTrackGraphImpl::GetInstance calling HashSet::add:
https://searchfox.org/firefox-main/rev/6b8eac08a185ecaa5ca23cc2f74b017743a89c26/dom/media/MediaTrackGraph.cpp#3591
12 bytes inside of 96-byte region, freed on the same thread at
mozilla::detail::HashTable<>::changeTableSize
https://searchfox.org/firefox-main/rev/6b8eac08a185ecaa5ca23cc2f74b017743a89c26/mfbt/HashTable.h#1916
MediaTrackGraphImpl::RemoveTrack() calling HashSet::remove:
https://searchfox.org/firefox-main/source/dom/media/MediaTrackGraph.cpp#3853

Comment 4

[Karl Tomlinson (:karlt)]

It's not the MediaTrack that is being accessed.
I suspect a HashTable structure.
The HashSet contains MediaTrackGraphImpl pointers; hard to imagine how MediaTrackGraphImpl could corrupt the HashTable structure, but apparently something has corrupted it.

Has this stack been seen more than once?

Comment 5

[Karl Tomlinson (:karlt)]

I don't have any leads on this one.

Comment 6

[BugBot [:suhaib / :marco]]

The severity field for this bug is set to S3. However, the bug is flagged with the sec-high keyword.
:jimm, could you consider increasing the severity of this security bug?

For more information, please visit BugBot documentation.

Comment 7

[Jim Mathies [:jimm]]

https://crash-stats.mozilla.org/report/index/d2d7e99d-59f3-40fc-b457-a5ea00250826#tab-details

Comment 8

[Karl Tomlinson (:karlt)]

I don't know how the EXCEPTION_ACCESS_VIOLATION_EXEC of comment 7 would happen with the stack in HashTable<>::rawCapacity(), but the recent frames are not aligning with cfi, so the stack may have been somewhat different.

https://crash-stats.mozilla.org/report/index/6a4ebaf5-c60d-439a-8598-fc63b0250407 is a corresponding crash in ESR115, which has a different hashtable interface.
We have 1981 crash reports in the last 7 days with PLDHashTable::WithEntryHandle in the stack (proto signature).
None of those have MediaTrackGraphImpl::GetInstance on the stack.

https://crash-stats.mozilla.org/report/index/fd3fa499-9cc4-4d96-afd4-1a1800250807 might be related, occurring while in lookupForAdd().
We have 88 crash reports in the last 7 days with the signature [@ mozilla::detail::EntrySlot<T>::isFree ].
2 in the last six months with the signature [@ mozilla::detail::EntrySlot<T>::isFree ] have MediaTrackGraphImpl::GetInstance on the stack.

Comment 9

[Karl Tomlinson (:karlt)]

Bug 1988931 has more of the free stack, which identifies how the hash table is mutated.