Closed Bug 2015179 (CVE-2026-2789) Opened 7 months ago Closed 7 months ago

AddressSanitizer: double-free /firefox/image/SourceBuffer.h:398:16 in mozilla::image::SourceBuffer::Chunk::~Chunk()

Categories

(Core :: Graphics: ImageLib, defect)

Product:
Core
Component:
Graphics: ImageLib
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
149 Branch
Tracking Flags:
Tracking Status
firefox-esr115 148+ fixed
firefox-esr140 148+ fixed
firefox147 --- wontfix
firefox148 + fixed
firefox149 + fixed

People

(Reporter: tsmith, Assigned: tnikkel)

References

(Regression)

Details

(6 keywords, Whiteboard: [potential sec-high for downstreams that replace jemalloc][adv-main148+] [adv-esr115.33+] [adv-esr140.8+])

Attachments

(6 files, 1 obsolete file)

testcase.html
1.01 KB, text/html
Details
(secure)
48 bytes, text/x-phabricator-request
dveditz
: sec-approval+
Details | Review
(secure)
48 bytes, text/x-phabricator-request
phab-bot
: approval-mozilla-beta+
Details | Review
(secure)
48 bytes, text/x-phabricator-request
phab-bot
: approval-mozilla-esr140+
Details | Review
(secure)
48 bytes, text/x-phabricator-request
phab-bot
: approval-mozilla-esr115+
Details | Review
advisory.txt
147 bytes, text/plain
Details
Attached file testcase.html —

Reproduced on mozilla-central rev 997d55938096 (built with: --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

# From within a firefox checkout
$ cp testcase.html <src>/testing/web-platform/tests/dom/abort/abort-signal-any-crash.html
$ ./mach web-platform-tests testing/web-platform/tests/dom/abort/abort-signal-any-crash.html

==76083==ERROR: AddressSanitizer: attempting double-free on 0x779b543ff800 in thread T0 (Isolated Web Co):
    #0 0x5f5a27e7a856 in free /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3
    #1 0x779b87c4225c in mozilla::image::SourceBuffer::Chunk::~Chunk() /home/user/code/firefox/image/SourceBuffer.h:398:16
    #2 0x779b87c4225c in nsTArrayElementTraits<mozilla::image::SourceBuffer::Chunk>::Destruct(mozilla::image::SourceBuffer::Chunk*) /home/user/code/firefox/objdir-ff-asan/dist/include/nsTArray.h:576:45
    #3 0x779b87c4225c in nsTArray_Impl<mozilla::image::SourceBuffer::Chunk, nsTArrayInfallibleAllocator>::DestructRange(unsigned long, unsigned long) /home/user/code/firefox/objdir-ff-asan/dist/include/nsTArray.h:2339:7
    #4 0x779b87c2b55c in nsTArray_Impl<mozilla::image::SourceBuffer::Chunk, nsTArrayInfallibleAllocator>::ClearAndRetainStorage() /home/user/code/firefox/objdir-ff-asan/dist/include/nsTArray.h:1363:5
    #5 0x779b87c2b55c in nsTArray_Impl<mozilla::image::SourceBuffer::Chunk, nsTArrayInfallibleAllocator>::~nsTArray_Impl() /home/user/code/firefox/objdir-ff-asan/dist/include/nsTArray.h:908:7
    #6 0x779b87c2b55c in mozilla::image::SourceBuffer::~SourceBuffer() /home/user/code/firefox/image/SourceBuffer.cpp:130:1
    #7 0x779b87c0f9a6 in mozilla::image::SourceBuffer::Release() /home/user/code/firefox/image/SourceBuffer.h:307:3
    #8 0x779b87c0f9a6 in mozilla::RefPtrTraits<mozilla::image::SourceBuffer>::Release(mozilla::image::SourceBuffer*) /home/user/code/firefox/objdir-ff-asan/dist/include/mozilla/RefPtr.h:49:40
    #9 0x779b87c0f9a6 in RefPtr<mozilla::image::SourceBuffer>::ConstRemovingRefPtrTraits<mozilla::image::SourceBuffer>::Release(mozilla::image::SourceBuffer*) /home/user/code/firefox/objdir-ff-asan/dist/include/mozilla/RefPtr.h:409:36
    #10 0x779b87c0f9a6 in RefPtr<mozilla::image::SourceBuffer>::~RefPtr() /home/user/code/firefox/objdir-ff-asan/dist/include/mozilla/RefPtr.h:80:7
    #11 0x779b87c0f9a6 in mozilla::detail::CopyablePtr<RefPtr<mozilla::image::SourceBuffer>>::~CopyablePtr() /home/user/code/firefox/objdir-ff-asan/dist/include/mozilla/NotNull.h:75:8
    #12 0x779b87c0f9a6 in mozilla::NotNull<RefPtr<mozilla::image::SourceBuffer>>::~NotNull() /home/user/code/firefox/objdir-ff-asan/dist/include/mozilla/NotNull.h:123:7
    #13 0x779b87c0f9a6 in mozilla::image::RasterImage::~RasterImage() /home/user/code/firefox/image/RasterImage.cpp:92:1
    #14 0x779b87c0f0fb in mozilla::image::RasterImage::Release() /home/user/code/firefox/image/RasterImage.cpp:61:1
    #15 0x779b87c06cd6 in mozilla::RefPtrTraits<mozilla::image::Image>::Release(mozilla::image::Image*) /home/user/code/firefox/objdir-ff-asan/dist/include/mozilla/RefPtr.h:49:40
    #16 0x779b87c06cd6 in RefPtr<mozilla::image::Image>::ConstRemovingRefPtrTraits<mozilla::image::Image>::Release(mozilla::image::Image*) /home/user/code/firefox/objdir-ff-asan/dist/include/mozilla/RefPtr.h:409:36
    #17 0x779b87c06cd6 in RefPtr<mozilla::image::Image>::~RefPtr() /home/user/code/firefox/objdir-ff-asan/dist/include/mozilla/RefPtr.h:80:7
    #18 0x779b87c06cd6 in mozilla::image::MultipartImage::OnImageDataComplete(nsIRequest*, nsresult, bool) /home/user/code/firefox/image/MultipartImage.cpp:330:1
    #19 0x779b87cb98dc in imgRequest::OnStopRequest(nsIRequest*, nsresult) /home/user/code/firefox/image/imgRequest.cpp:781:26
    #20 0x779b841eec50 in nsPartChannel::SendOnStopRequest(nsISupports*, nsresult) /home/user/code/firefox/netwerk/streamconv/converters/nsMultiMixedConv.cpp:63:20
    #21 0x779b841eec50 in nsMultiMixedConv::SendStop(nsresult) /home/user/code/firefox/netwerk/streamconv/converters/nsMultiMixedConv.cpp:900:24
    #22 0x779b841ef771 in nsMultiMixedConv::ConsumeToken(mozilla::TokenizerBase<char>::Token const&) /home/user/code/firefox/netwerk/streamconv/converters/nsMultiMixedConv.cpp:760:14
    #23 0x779b833ddff9 in std::function<nsresult (mozilla::TokenizerBase<char>::Token const&, mozilla::IncrementalTokenizer&)>::operator()(mozilla::TokenizerBase<char>::Token const&, mozilla::IncrementalTokenizer&) const /home/user/.mozbuild/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/std_function.h:622:14
    #24 0x779b833ddff9 in mozilla::IncrementalTokenizer::Process() /home/user/code/firefox/xpcom/ds/IncrementalTokenizer.cpp:173:10
    #25 0x779b833de5c4 in mozilla::IncrementalTokenizer::FeedInput(nsIInputStream*, unsigned int) /home/user/code/firefox/xpcom/ds/IncrementalTokenizer.cpp:83:12
    #26 0x779b841ee097 in nsMultiMixedConv::OnDataAvailable(nsIRequest*, nsIInputStream*, unsigned long, unsigned int) /home/user/code/firefox/netwerk/streamconv/converters/nsMultiMixedConv.cpp:560:33
    #27 0x779b845c89f3 in mozilla::net::HttpChannelChild::DoOnDataAvailable(nsIRequest*, nsIInputStream*, unsigned long, unsigned int) /home/user/code/firefox/netwerk/protocol/http/HttpChannelChild.cpp:828:29
    #28 0x779b845c674c in mozilla::net::HttpChannelChild::OnTransportAndData(nsresult const&, nsresult const&, unsigned long const&, unsigned int const&, nsTSubstring<char> const&) /home/user/code/firefox/netwerk/protocol/http/HttpChannelChild.cpp:721:3
    #29 0x779b84a6f943 in mozilla::net::ChannelEventQueue::FlushQueue() /home/user/code/firefox/netwerk/ipc/ChannelEventQueue.cpp:84:14
    #30 0x779b84abfa51 in mozilla::net::ChannelEventQueue::MaybeFlushQueue() /home/user/code/firefox/netwerk/ipc/ChannelEventQueue.h:351:5
    #31 0x779b84abfa51 in mozilla::net::ChannelEventQueue::CompleteResume() /home/user/code/firefox/netwerk/ipc/ChannelEventQueue.h:336:5
    #32 0x779b84abfa51 in mozilla::net::ChannelEventQueue::ResumeInternal()::CompleteResumeRunnable::Run() /home/user/code/firefox/netwerk/ipc/ChannelEventQueue.cpp:143:17
    #33 0x779b83527aca in mozilla::RunnableTask::Run() /home/user/code/firefox/xpcom/threads/TaskController.cpp:705:16
    #34 0x779b835102cb in mozilla::TaskController::RunTask(mozilla::Task*) /home/user/code/firefox/xpcom/threads/TaskController.cpp:196:19
    #35 0x779b835173ad in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /home/user/code/firefox/xpcom/threads/TaskController.cpp:1325:20
    #36 0x779b83514c08 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /home/user/code/firefox/xpcom/threads/TaskController.cpp:1148:15
    #37 0x779b83515226 in mozilla::TaskController::ProcessPendingMTTask(bool) /home/user/code/firefox/xpcom/threads/TaskController.cpp:641:36
    #38 0x779b8351c1a4 in mozilla::TaskController::TaskController()::$_1::operator()() const /home/user/code/firefox/xpcom/threads/TaskController.cpp:336:37
    #39 0x779b8351c1a4 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /home/user/code/firefox/xpcom/threads/nsThreadUtils.h:549:5
    #40 0x779b8355dc2a in nsThread::ProcessNextEvent(bool, bool*) /home/user/code/firefox/xpcom/threads/nsThread.cpp:1168:16
    #41 0x779b83566b29 in NS_ProcessNextEvent(nsIThread*, bool) /home/user/code/firefox/xpcom/threads/nsThreadUtils.cpp:461:10
    #42 0x779b8504c0f3 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /home/user/code/firefox/ipc/glue/MessagePump.cpp:107:5
    #43 0x779b84e90464 in MessageLoop::RunInternal() /home/user/code/firefox/ipc/chromium/src/base/message_loop.cc:373:10
    #44 0x779b84e90464 in MessageLoop::RunHandler() /home/user/code/firefox/ipc/chromium/src/base/message_loop.cc:366:3
    #45 0x779b84e90464 in MessageLoop::Run() /home/user/code/firefox/ipc/chromium/src/base/message_loop.cc:348:3
    #46 0x779b8fea8676 in nsBaseAppShell::Run() /home/user/code/firefox/widget/nsBaseAppShell.cpp:152:27
    #47 0x779b900ade9b in nsAppShell::Run() /home/user/code/firefox/widget/gtk/nsAppShell.cpp:555:33
    #48 0x779b9251c4dd in XRE_RunAppShell() /home/user/code/firefox/toolkit/xre/nsEmbedFunctions.cpp:652:20
    #49 0x779b84e90464 in MessageLoop::RunInternal() /home/user/code/firefox/ipc/chromium/src/base/message_loop.cc:373:10
    #50 0x779b84e90464 in MessageLoop::RunHandler() /home/user/code/firefox/ipc/chromium/src/base/message_loop.cc:366:3
    #51 0x779b84e90464 in MessageLoop::Run() /home/user/code/firefox/ipc/chromium/src/base/message_loop.cc:348:3
    #52 0x779b9251bcbc in XRE_InitChildProcess(int, char**, XREChildData const*) /home/user/code/firefox/toolkit/xre/nsEmbedFunctions.cpp:590:34
    #53 0x5f5a27ec002a in main /home/user/code/firefox/browser/app/nsBrowserApp.cpp:465:22
    #54 0x7b9ba502a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #55 0x7b9ba502a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #56 0x5f5a27dd9608 in _start (/home/user/code/firefox/objdir-ff-asan/dist/bin/firefox+0xd6608) (BuildId: 594d9d845149c7e9f8c79aaf20a2a11f)
0x779b543ff800 is located 0 bytes inside of 20971520-byte region [0x779b543ff800,0x779b557ff800)
freed by thread T0 (Isolated Web Co) here:
    #0 0x5f5a27e7ad8c in realloc /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:81:3
    #1 0x779b87c2c328 in mozilla::image::SourceBuffer::Chunk::SetCapacity(unsigned long) /home/user/code/firefox/image/SourceBuffer.h:434:39
    #2 0x779b87c2c328 in mozilla::image::SourceBuffer::Compact() /home/user/code/firefox/image/SourceBuffer.cpp:209:29
    #3 0x779b87bfde4d in mozilla::image::SourceBuffer::Complete(nsresult) /home/user/code/firefox/image/SourceBuffer.cpp:532:3
    #4 0x779b87c1c717 in mozilla::image::RasterImage::OnImageDataComplete(nsIRequest*, nsresult, bool) /home/user/code/firefox/image/RasterImage.cpp:884:18
    #5 0x779b87c06c9d in mozilla::image::MultipartImage::OnImageDataComplete(nsIRequest*, nsresult, bool) /home/user/code/firefox/image/MultipartImage.cpp:324:15
    #6 0x779b87cb98dc in imgRequest::OnStopRequest(nsIRequest*, nsresult) /home/user/code/firefox/image/imgRequest.cpp:781:26
    #7 0x779b841eec50 in nsPartChannel::SendOnStopRequest(nsISupports*, nsresult) /home/user/code/firefox/netwerk/streamconv/converters/nsMultiMixedConv.cpp:63:20
    #8 0x779b841eec50 in nsMultiMixedConv::SendStop(nsresult) /home/user/code/firefox/netwerk/streamconv/converters/nsMultiMixedConv.cpp:900:24
    #9 0x779b841ef771 in nsMultiMixedConv::ConsumeToken(mozilla::TokenizerBase<char>::Token const&) /home/user/code/firefox/netwerk/streamconv/converters/nsMultiMixedConv.cpp:760:14
    #10 0x779b833ddff9 in std::function<nsresult (mozilla::TokenizerBase<char>::Token const&, mozilla::IncrementalTokenizer&)>::operator()(mozilla::TokenizerBase<char>::Token const&, mozilla::IncrementalTokenizer&) const /home/user/.mozbuild/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/std_function.h:622:14
    #11 0x779b833ddff9 in mozilla::IncrementalTokenizer::Process() /home/user/code/firefox/xpcom/ds/IncrementalTokenizer.cpp:173:10
    #12 0x779b833de5c4 in mozilla::IncrementalTokenizer::FeedInput(nsIInputStream*, unsigned int) /home/user/code/firefox/xpcom/ds/IncrementalTokenizer.cpp:83:12
    #13 0x779b841ee097 in nsMultiMixedConv::OnDataAvailable(nsIRequest*, nsIInputStream*, unsigned long, unsigned int) /home/user/code/firefox/netwerk/streamconv/converters/nsMultiMixedConv.cpp:560:33
    #14 0x779b845c89f3 in mozilla::net::HttpChannelChild::DoOnDataAvailable(nsIRequest*, nsIInputStream*, unsigned long, unsigned int) /home/user/code/firefox/netwerk/protocol/http/HttpChannelChild.cpp:828:29
    #15 0x779b845c674c in mozilla::net::HttpChannelChild::OnTransportAndData(nsresult const&, nsresult const&, unsigned long const&, unsigned int const&, nsTSubstring<char> const&) /home/user/code/firefox/netwerk/protocol/http/HttpChannelChild.cpp:721:3
    #16 0x779b84a6f943 in mozilla::net::ChannelEventQueue::FlushQueue() /home/user/code/firefox/netwerk/ipc/ChannelEventQueue.cpp:84:14
    #17 0x779b84abfa51 in mozilla::net::ChannelEventQueue::MaybeFlushQueue() /home/user/code/firefox/netwerk/ipc/ChannelEventQueue.h:351:5
    #18 0x779b84abfa51 in mozilla::net::ChannelEventQueue::CompleteResume() /home/user/code/firefox/netwerk/ipc/ChannelEventQueue.h:336:5
    #19 0x779b84abfa51 in mozilla::net::ChannelEventQueue::ResumeInternal()::CompleteResumeRunnable::Run() /home/user/code/firefox/netwerk/ipc/ChannelEventQueue.cpp:143:17
    #20 0x779b83527aca in mozilla::RunnableTask::Run() /home/user/code/firefox/xpcom/threads/TaskController.cpp:705:16
    #21 0x779b835102cb in mozilla::TaskController::RunTask(mozilla::Task*) /home/user/code/firefox/xpcom/threads/TaskController.cpp:196:19
    #22 0x779b835173ad in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /home/user/code/firefox/xpcom/threads/TaskController.cpp:1325:20
    #23 0x779b83514c08 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /home/user/code/firefox/xpcom/threads/TaskController.cpp:1148:15
    #24 0x779b83515226 in mozilla::TaskController::ProcessPendingMTTask(bool) /home/user/code/firefox/xpcom/threads/TaskController.cpp:641:36
    #25 0x779b8351c1a4 in mozilla::TaskController::TaskController()::$_1::operator()() const /home/user/code/firefox/xpcom/threads/TaskController.cpp:336:37
    #26 0x779b8351c1a4 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /home/user/code/firefox/xpcom/threads/nsThreadUtils.h:549:5
    #27 0x779b8355dc2a in nsThread::ProcessNextEvent(bool, bool*) /home/user/code/firefox/xpcom/threads/nsThread.cpp:1168:16
    #28 0x779b83566b29 in NS_ProcessNextEvent(nsIThread*, bool) /home/user/code/firefox/xpcom/threads/nsThreadUtils.cpp:461:10
    #29 0x779b8504c0f3 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /home/user/code/firefox/ipc/glue/MessagePump.cpp:107:5
    #30 0x779b84e90464 in MessageLoop::RunInternal() /home/user/code/firefox/ipc/chromium/src/base/message_loop.cc:373:10
    #31 0x779b84e90464 in MessageLoop::RunHandler() /home/user/code/firefox/ipc/chromium/src/base/message_loop.cc:366:3
    #32 0x779b84e90464 in MessageLoop::Run() /home/user/code/firefox/ipc/chromium/src/base/message_loop.cc:348:3
    #33 0x779b8fea8676 in nsBaseAppShell::Run() /home/user/code/firefox/widget/nsBaseAppShell.cpp:152:27
    #34 0x779b900ade9b in nsAppShell::Run() /home/user/code/firefox/widget/gtk/nsAppShell.cpp:555:33
    #35 0x779b9251c4dd in XRE_RunAppShell() /home/user/code/firefox/toolkit/xre/nsEmbedFunctions.cpp:652:20
    #36 0x779b84e90464 in MessageLoop::RunInternal() /home/user/code/firefox/ipc/chromium/src/base/message_loop.cc:373:10
    #37 0x779b84e90464 in MessageLoop::RunHandler() /home/user/code/firefox/ipc/chromium/src/base/message_loop.cc:366:3
    #38 0x779b84e90464 in MessageLoop::Run() /home/user/code/firefox/ipc/chromium/src/base/message_loop.cc:348:3
    #39 0x779b9251bcbc in XRE_InitChildProcess(int, char**, XREChildData const*) /home/user/code/firefox/toolkit/xre/nsEmbedFunctions.cpp:590:34
previously allocated by thread T0 (Isolated Web Co) here:
    #0 0x5f5a27e7aaf4 in malloc /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3
    #1 0x779b87bfd72a in mozilla::image::SourceBuffer::Chunk::Chunk(unsigned long) /home/user/code/firefox/image/SourceBuffer.h:386:34
    #2 0x779b87bfd72a in mozilla::image::SourceBuffer::CreateChunk(unsigned long, unsigned long, bool) /home/user/code/firefox/image/SourceBuffer.cpp:171:15
    #3 0x779b87bfd72a in mozilla::image::SourceBuffer::ExpectLength(unsigned long) /home/user/code/firefox/image/SourceBuffer.cpp:338:7
    #4 0x779b87bf89c8 in mozilla::image::RasterImage::SetSourceSizeHint(unsigned int) /home/user/code/firefox/image/RasterImage.cpp:966:32
    #5 0x779b87bf89c8 in mozilla::image::ImageFactory::CreateRasterImage(nsIRequest*, mozilla::image::ProgressTracker*, nsTString<char> const&, nsIURI*, unsigned int, unsigned long) /home/user/code/firefox/image/ImageFactory.cpp:238:18
    #6 0x779b87bf7f32 in mozilla::image::ImageFactory::CreateImage(nsIRequest*, mozilla::image::ProgressTracker*, nsTString<char> const&, nsIURI*, bool, unsigned long) /home/user/code/firefox/image/ImageFactory.cpp:127:12
    #7 0x779b87cbaa7c in PrepareForNewPart(nsIRequest*, nsIInputStream*, unsigned int, nsIURI*, bool, mozilla::image::Image*, mozilla::image::ProgressTracker*, unsigned long) /home/user/code/firefox/image/imgRequest.cpp:909:38
    #8 0x779b87cbaa7c in imgRequest::OnDataAvailable(nsIRequest*, nsIInputStream*, unsigned long, unsigned int) /home/user/code/firefox/image/imgRequest.cpp:1022:9
    #9 0x779b87cb941c in imgRequest::OnStopRequest(nsIRequest*, nsresult) /home/user/code/firefox/image/imgRequest.cpp:744:5
    #10 0x779b841eec50 in nsPartChannel::SendOnStopRequest(nsISupports*, nsresult) /home/user/code/firefox/netwerk/streamconv/converters/nsMultiMixedConv.cpp:63:20
    #11 0x779b841eec50 in nsMultiMixedConv::SendStop(nsresult) /home/user/code/firefox/netwerk/streamconv/converters/nsMultiMixedConv.cpp:900:24
    #12 0x779b841ef771 in nsMultiMixedConv::ConsumeToken(mozilla::TokenizerBase<char>::Token const&) /home/user/code/firefox/netwerk/streamconv/converters/nsMultiMixedConv.cpp:760:14
    #13 0x779b833ddff9 in std::function<nsresult (mozilla::TokenizerBase<char>::Token const&, mozilla::IncrementalTokenizer&)>::operator()(mozilla::TokenizerBase<char>::Token const&, mozilla::IncrementalTokenizer&) const /home/user/.mozbuild/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/std_function.h:622:14
    #14 0x779b833ddff9 in mozilla::IncrementalTokenizer::Process() /home/user/code/firefox/xpcom/ds/IncrementalTokenizer.cpp:173:10
    #15 0x779b833de5c4 in mozilla::IncrementalTokenizer::FeedInput(nsIInputStream*, unsigned int) /home/user/code/firefox/xpcom/ds/IncrementalTokenizer.cpp:83:12
    #16 0x779b841ee097 in nsMultiMixedConv::OnDataAvailable(nsIRequest*, nsIInputStream*, unsigned long, unsigned int) /home/user/code/firefox/netwerk/streamconv/converters/nsMultiMixedConv.cpp:560:33
    #17 0x779b845c89f3 in mozilla::net::HttpChannelChild::DoOnDataAvailable(nsIRequest*, nsIInputStream*, unsigned long, unsigned int) /home/user/code/firefox/netwerk/protocol/http/HttpChannelChild.cpp:828:29
    #18 0x779b845c674c in mozilla::net::HttpChannelChild::OnTransportAndData(nsresult const&, nsresult const&, unsigned long const&, unsigned int const&, nsTSubstring<char> const&) /home/user/code/firefox/netwerk/protocol/http/HttpChannelChild.cpp:721:3
    #19 0x779b84a6f943 in mozilla::net::ChannelEventQueue::FlushQueue() /home/user/code/firefox/netwerk/ipc/ChannelEventQueue.cpp:84:14
    #20 0x779b84abfa51 in mozilla::net::ChannelEventQueue::MaybeFlushQueue() /home/user/code/firefox/netwerk/ipc/ChannelEventQueue.h:351:5
    #21 0x779b84abfa51 in mozilla::net::ChannelEventQueue::CompleteResume() /home/user/code/firefox/netwerk/ipc/ChannelEventQueue.h:336:5
    #22 0x779b84abfa51 in mozilla::net::ChannelEventQueue::ResumeInternal()::CompleteResumeRunnable::Run() /home/user/code/firefox/netwerk/ipc/ChannelEventQueue.cpp:143:17
    #23 0x779b83527aca in mozilla::RunnableTask::Run() /home/user/code/firefox/xpcom/threads/TaskController.cpp:705:16
    #24 0x779b835102cb in mozilla::TaskController::RunTask(mozilla::Task*) /home/user/code/firefox/xpcom/threads/TaskController.cpp:196:19
    #25 0x779b835173ad in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /home/user/code/firefox/xpcom/threads/TaskController.cpp:1325:20
    #26 0x779b83514c08 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /home/user/code/firefox/xpcom/threads/TaskController.cpp:1148:15
    #27 0x779b83515226 in mozilla::TaskController::ProcessPendingMTTask(bool) /home/user/code/firefox/xpcom/threads/TaskController.cpp:641:36
    #28 0x779b8351c1a4 in mozilla::TaskController::TaskController()::$_1::operator()() const /home/user/code/firefox/xpcom/threads/TaskController.cpp:336:37
    #29 0x779b8351c1a4 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /home/user/code/firefox/xpcom/threads/nsThreadUtils.h:549:5
    #30 0x779b8355dc2a in nsThread::ProcessNextEvent(bool, bool*) /home/user/code/firefox/xpcom/threads/nsThread.cpp:1168:16
    #31 0x779b83566b29 in NS_ProcessNextEvent(nsIThread*, bool) /home/user/code/firefox/xpcom/threads/nsThreadUtils.cpp:461:10
    #32 0x779b8504c0f3 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /home/user/code/firefox/ipc/glue/MessagePump.cpp:107:5
    #33 0x779b84e90464 in MessageLoop::RunInternal() /home/user/code/firefox/ipc/chromium/src/base/message_loop.cc:373:10
    #34 0x779b84e90464 in MessageLoop::RunHandler() /home/user/code/firefox/ipc/chromium/src/base/message_loop.cc:366:3
    #35 0x779b84e90464 in MessageLoop::Run() /home/user/code/firefox/ipc/chromium/src/base/message_loop.cc:348:3
    #36 0x779b8fea8676 in nsBaseAppShell::Run() /home/user/code/firefox/widget/nsBaseAppShell.cpp:152:27
    #37 0x779b900ade9b in nsAppShell::Run() /home/user/code/firefox/widget/gtk/nsAppShell.cpp:555:33
    #38 0x779b9251c4dd in XRE_RunAppShell() /home/user/code/firefox/toolkit/xre/nsEmbedFunctions.cpp:652:20
    #39 0x779b84e90464 in MessageLoop::RunInternal() /home/user/code/firefox/ipc/chromium/src/base/message_loop.cc:373:10
    #40 0x779b84e90464 in MessageLoop::RunHandler() /home/user/code/firefox/ipc/chromium/src/base/message_loop.cc:366:3
    #41 0x779b84e90464 in MessageLoop::Run() /home/user/code/firefox/ipc/chromium/src/base/message_loop.cc:348:3
    #42 0x779b9251bcbc in XRE_InitChildProcess(int, char**, XREChildData const*) /home/user/code/firefox/toolkit/xre/nsEmbedFunctions.cpp:590:34
SUMMARY: AddressSanitizer: double-free /home/user/code/firefox/image/SourceBuffer.h:398:16 in mozilla::image::SourceBuffer::Chunk::~Chunk()

Looks like we are doing a realloc(..., 0) which in this case frees the memory, but googling suggests this is implementation dependant, so we should maybe have a sanitizer or something that disallows realloc's of size zero to avoid this type of problem. I can fix up this specific case though so the code doesn't get confused by it here.

Assignee: nobody → tnikkel
Keywords: regression
Regressed by: 1383404

Set release status flags based on info from the regressing bug 1383404

status-firefox147: --- → affected
status-firefox148: --- → affected
status-firefox-esr140: --- → affected

It looks like in a regular local build realloc(...,0) returns a non-null pointer. Asan builds look to disable jemalloc, so they seem to treat this as a free. So probably most of our users are not affected by this.

Regressed by: 1453454
No longer regressed by: 1383404
Attached file (secure) —

The SourceBuffer::Compact change is the fix for this bug. The other changes are things I noticed or pro-active defensive fixes.

Not sure if I'm allowed to include the testcase as a test in the patch?

Flags: needinfo?(twsmith)

(In reply to Timothy Nikkel (:tnikkel) from comment #5)

Not sure if I'm allowed to include the testcase as a test in the patch?

Forwarding to decoder

Flags: needinfo?(twsmith) → needinfo?(choller)

(In reply to Timothy Nikkel (:tnikkel) from comment #5)

Not sure if I'm allowed to include the testcase as a test in the patch?

Don't land the testcase with the patch as this is a sec-bug, but we should tag the bug to land the testcase later when the fix is released. I think we do have a reminder keyword/whiteboard tag for this, forwarding to :dveditz.

Flags: needinfo?(choller) → needinfo?(dveditz)

What is the sec rating on this? I'm wondering if it will need uplift requests for the affected versions once it lands.

status-firefox147: affected → wontfix

Not sure but comment 3 is important when deciding the sec rating. Our official builds look like they are not affected.

(In reply to Timothy Nikkel (:tnikkel) from comment #3)

It looks like in a regular local build realloc(...,0) returns a non-null pointer. Asan builds look to disable jemalloc, so they seem to treat this as a free. So probably most of our users are not affected by this.

Mike, can you confirm that this double-free might not be an issue when jemalloc is used? It sounds weird to me that ASan would report something as double-free that would be harmless otherwise.

Flags: needinfo?(mh+mozilla)

As per comment 1, it's implementation dependent, and asan is considering realloc to 0 size as free().
mozjemalloc considers it as a realloc to size 1. https://searchfox.org/firefox-main/rev/49309478bd68574d689aba86e5f55a492e9e2c76/memory/build/mozjemalloc.cpp#4280-4281

Flags: needinfo?(mh+mozilla)

Comment on attachment 9543335 [details]
(secure)

Security Approval Request

  • How easily could an exploit be constructed based on the patch?: probably not hard for an attacker to tell what the problem is, but our official builds aren't vulnerable because our realloc doesn't free
  • Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: Yes
  • Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: all
  • If not all supported branches, which bug introduced the flaw?: None
  • Do you have backports for the affected branches?: No
  • If not, how different, hard to create, and risky will they be?: should be very easy to backport
  • How likely is this patch to cause regressions; how much testing does it need?: not likely
  • Is the patch ready to land after security approval is given?: Yes
  • Is Android affected?: Yes
Attachment #9543335 - Flags: sec-approval?
Flags: needinfo?(dveditz)
Keywords: sec-moderate
Whiteboard: [potential sec-high for downstreams that replace jemalloc][reminder-test 2026-04-07]

Comment on attachment 9543335 [details]
(secure)

sec-approval+, a=dveditz

Attachment #9543335 - Flags: sec-approval? → sec-approval+
Pushed by tnikkel@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/7c12570b0e11 https://hg.mozilla.org/integration/autoland/rev/dafa6e824c98 In image SourceBuffer, don't set the capacity of a chunk to zero, just remove the chunk. r=gfx-reviewers,lsalzman

firefox-beta Uplift Approval Request

  • User impact if declined: sec-moderate, affects any downstream that doesn't use jemalloc in their build
  • Code covered by automated testing: yes
  • Fix verified in Nightly: no
  • Needs manual QE test: no
  • Steps to reproduce for manual QE testing:
  • Risk associated with taking this patch: low
  • Explanation of risk level: simple patch handling the zero length condition
  • String changes made/needed: none
  • Is Android affected?: yes
Attachment #9543821 - Flags: approval-mozilla-beta?
Attached file (secure) —

The SourceBuffer::Compact change is the fix for this bug. The other changes are things I noticed or pro-active defensive fixes.

Original Revision: https://phabricator.services.mozilla.com/D282263

Attached file (secure) —

The SourceBuffer::Compact change is the fix for this bug. The other changes are things I noticed or pro-active defensive fixes.

Original Revision: https://phabricator.services.mozilla.com/D282263

Attachment #9543830 - Flags: approval-mozilla-esr140?

firefox-esr140 Uplift Approval Request

  • User impact if declined: sec-moderate, affects any downstream that doesn't use jemalloc in their build
  • Code covered by automated testing: yes
  • Fix verified in Nightly: no
  • Needs manual QE test: no
  • Steps to reproduce for manual QE testing:
  • Risk associated with taking this patch: low
  • Explanation of risk level: simple patch handling the zero length condition
  • String changes made/needed: none
  • Is Android affected?: yes
Attached file (secure) —

The SourceBuffer::Compact change is the fix for this bug. The other changes are things I noticed or pro-active defensive fixes.

Original Revision: https://phabricator.services.mozilla.com/D282263

Attachment #9543831 - Flags: approval-mozilla-esr115?

firefox-esr115 Uplift Approval Request

  • User impact if declined: sec-moderate, affects any downstream that doesn't use jemalloc in their build
  • Code covered by automated testing: yes
  • Fix verified in Nightly: no
  • Needs manual QE test: no
  • Steps to reproduce for manual QE testing:
  • Risk associated with taking this patch: low
  • Explanation of risk level: simple patch handling the zero length condition
  • String changes made/needed: none
  • Is Android affected?: yes

https://hg.mozilla.org/mozilla-central/rev/dafa6e824c98

Group: gfx-core-security → core-security-release
Status: NEW → RESOLVED
Closed: 7 months ago
status-firefox149: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 149 Branch
Attachment #9543821 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Attached file (secure) (obsolete) —
QA Whiteboard: [sec] [uplift] [qa-triage-done-c149/b148]
Attachment #9543830 - Flags: approval-mozilla-esr140? → approval-mozilla-esr140+
Attachment #9543831 - Flags: approval-mozilla-esr115? → approval-mozilla-esr115+
Whiteboard: [potential sec-high for downstreams that replace jemalloc][reminder-test 2026-04-07] → [potential sec-high for downstreams that replace jemalloc][reminder-test 2026-04-07][adv-main148+]
Regressions: 2017477
No longer regressions: 2017477
Whiteboard: [potential sec-high for downstreams that replace jemalloc][reminder-test 2026-04-07][adv-main148+] → [potential sec-high for downstreams that replace jemalloc][reminder-test 2026-04-07][adv-main148+] [adv-esr115.33+]
Whiteboard: [potential sec-high for downstreams that replace jemalloc][reminder-test 2026-04-07][adv-main148+] [adv-esr115.33+] → [potential sec-high for downstreams that replace jemalloc][reminder-test 2026-04-07][adv-main148+] [adv-esr115.33+] [adv-esr140.8+]
Alias: CVE-2026-2789

2 months ago, dveditz placed a reminder on the bug using the whiteboard tag [reminder-test 2026-04-07] .

tnikkel, please refer to the original comment to better understand the reason for the reminder.

Flags: needinfo?(tnikkel)
Whiteboard: [potential sec-high for downstreams that replace jemalloc][reminder-test 2026-04-07][adv-main148+] [adv-esr115.33+] [adv-esr140.8+] → [potential sec-high for downstreams that replace jemalloc][adv-main148+] [adv-esr115.33+] [adv-esr140.8+]
Blocks: 2030477

Comment on attachment 9544019 [details]
(secure)

Revision D282698 was moved to bug 2030477. Setting attachment 9544019 [details] to obsolete.

Attachment #9544019 - Attachment is obsolete: true

Landed test in bug 2030477.

Flags: needinfo?(tnikkel)
Group: core-security-release
Keywords: keep-hidden
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: