2027883 - AddressSanitizer: ILL on unknown address 0x73711f3ab2bd [@ _cairo_pdf_surface_emit_image]

Status: VERIFIED FIXED

(Core :: Graphics: Canvas2D, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 086d14f42154 (built with: --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework pipx --upgrade
$ python -m pipx ensurepath
$ fuzzfetch --build 086d14f42154 --asan --fuzzing  -n firefox
$ grizzly-replay-bugzilla ./firefox/firefox <bugid>

AddressSanitizer: ILL on unknown address 0x73711f3ab2bd [@ _cairo_pdf_surface_emit_image]

    =================================================================
    ==2698814==ERROR: AddressSanitizer: ILL on unknown address 0x73711f3ab2bd (pc 0x73711f3ab2bd bp 0x7ffdbdaec7f0 sp 0x7ffdbdaec6c0 T0)
        #0 0x73711f3ab2bd in _cairo_pdf_surface_emit_image /gfx/cairo/cairo/src/cairo-pdf-surface.c:3322:17
        #1 0x73711f3a13f9 in _cairo_pdf_surface_emit_surface /gfx/cairo/cairo/src/cairo-pdf-surface.c:4083:11
        #2 0x73711f39eb96 in _cairo_pdf_surface_write_patterns_and_smask_groups /gfx/cairo/cairo/src/cairo-pdf-surface.c:7757:15
        #3 0x73711f395be0 in _cairo_pdf_surface_write_page /gfx/cairo/cairo/src/cairo-pdf-surface.c:7858:14
        #4 0x73711f395be0 in _cairo_pdf_surface_show_page /gfx/cairo/cairo/src/cairo-pdf-surface.c:5673:14
        #5 0x73711f4bf188 in _moz_cairo_surface_show_page /gfx/cairo/cairo/src/cairo-surface.c:2582:40
        #6 0x73711f4653ac in _cairo_paginated_surface_show_page /gfx/cairo/cairo/src/cairo-paginated-surface.c:605:5
        #7 0x73711f4bf188 in _moz_cairo_surface_show_page /gfx/cairo/cairo/src/cairo-surface.c:2582:40
        #8 0x7371206af019 in mozilla::gfx::PrintTargetPDF::EndPage() /gfx/thebes/PrintTargetPDF.cpp:100:3
        #9 0x73711f7fe4db in nsDeviceContext::EndPage() /gfx/src/nsDeviceContext.cpp:350:5
        #10 0x73712987c110 in mozilla::layout::RemotePrintJobParent::PrintPage(mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layout::PRFileDescStream&, nsRefCountedHashtable<nsIntegralHashKey<unsigned long, 0>, RefPtr<mozilla::gfx::RecordedDependentSurface>>*) /layout/printing/ipc/RemotePrintJobParent.cpp:211:29
        #11 0x73712987bc61 in mozilla::layout::RemotePrintJobParent::FinishProcessingPage(mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&, nsRefCountedHashtable<nsIntegralHashKey<unsigned long, 0>, RefPtr<mozilla::gfx::RecordedDependentSurface>>*) /layout/printing/ipc/RemotePrintJobParent.cpp:184:17
        #12 0x73712987b92a in mozilla::layout::RemotePrintJobParent::RecvProcessPage(int const&, int const&, nsTArray<unsigned long>&&) /layout/printing/ipc/RemotePrintJobParent.cpp:154:5
        #13 0x737128d76e51 in mozilla::layout::PRemotePrintJobParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PRemotePrintJobParent.cpp:391:52
        #14 0x737127ba1db0 in mozilla::dom::PContentParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentParent.cpp:6540:32
        #15 0x73711eac5cd5 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:1798:25
        #16 0x73711eac21ce in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, std::unique_ptr<IPC::Message, std::default_delete<IPC::Message>>) /ipc/glue/MessageChannel.cpp:1724:9
        #17 0x73711eac2fe7 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /ipc/glue/MessageChannel.cpp:1513:3
        #18 0x73711eac4503 in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1615:14
        #19 0x73711d3e059a in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:719:16
        #20 0x73711d3d5771 in mozilla::TaskController::RunTask(mozilla::Task*) /xpcom/threads/TaskController.cpp:210:19
        #21 0x73711d3dca6d in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1358:20
        #22 0x73711d3da548 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1181:15
        #23 0x73711d3dab66 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:655:36
        #24 0x73711d3f3a31 in operator() /xpcom/threads/TaskController.cpp:347:37
        #25 0x73711d3f3a31 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /xpcom/threads/nsThreadUtils.h:547:5
        #26 0x73711d41720c in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1179:16
        #27 0x73711d420359 in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #28 0x73711eacf42e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:83:21
        #29 0x73711e9ad8f4 in RunInternal /ipc/chromium/src/base/message_loop.cc:371:10
        #30 0x73711e9ad8f4 in RunHandler /ipc/chromium/src/base/message_loop.cc:364:3
        #31 0x73711e9ad8f4 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:346:3
        #32 0x73712878cee6 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:151:27
        #33 0x73712897401b in nsAppShell::Run() /widget/gtk/nsAppShell.cpp:553:33
        #34 0x73712a79b5a5 in nsAppStartup::Run() /toolkit/components/startup/nsAppStartup.cpp:290:30
        #35 0x73712aa1c790 in XREMain::XRE_mainRun() /toolkit/xre/nsAppRunner.cpp:5940:22
        #36 0x73712aa1e2c2 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /toolkit/xre/nsAppRunner.cpp:6195:8
        #37 0x73712aa1f373 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /toolkit/xre/nsAppRunner.cpp:6268:21
        #38 0x577947281c3a in do_main /browser/app/nsBrowserApp.cpp:270:22
        #39 0x577947281c3a in main /browser/app/nsBrowserApp.cpp:534:16
        #40 0x777143e2a1c9 in __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #41 0x777143e2a28a in __libc_start_main ./csu/../csu/libc-start.c:360:3
        #42 0x57794719b818 in _start ??:0:0
    
    ==2698814==Register values:
    rax = 0x00000000ff404040  rbx = 0x00007ffdbdaec6c0  rcx = 0xffffffff80000001  rdx = 0x0000736ebe6eb801
    rdi = 0x000074b14319c500  rsi = 0x0000000000000040  rbp = 0x00007ffdbdaec7f0  rsp = 0x00007ffdbdaec6c0
     r8 = 0x000000000000425e   r9 = 0x0000000000000000  r10 = 0x000073707e55b2b0  r11 = 0x0000000000ff4040
    r12 = 0x0000736f3e6eb800  r13 = 0x0000000000000001  r14 = 0x0000000080000001  r15 = 0x0000000092f6c1f9
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: ILL (/home/jkratzer/builds/m-c-20260329205327-fuzzing-asan-opt/libxul.so+0x8bab2bd) (BuildId: 8c8b4e0b3fb2c2bc4be989706b3631ca395252e3)
    ==2698814==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260330213624-0b76dd137a61.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: befa35dc6ab4806b8008138d38f7a053a7fd7fd3 (20250401212749)
End: 086d14f4215495401f6eafe03c8a4951ad85d368 (20260329205327)
BuildFlags: BuildFlags(asan=True, tsan=False, debug=False, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Comment 3

[Bob Hood [:bhood]]

Setting component to Canvas2D since Ciaro is involved.

Comment 4

[Daniel Veditz [:dveditz]]

I can't think of reasons for a reproducible SIGILL that aren't bad news.

Comment 5

[BugBot [:suhaib / :marco]]

The severity field for this bug is set to S3. However, the bug is flagged with the sec-high keyword.
:lsalzman, could you consider increasing the severity of this security bug?

For more information, please visit BugBot documentation.

Comment 6

[Andy Leiserson [:aleiserson]]

Attachment: (secure)

Comment 7

[Andy Leiserson [:aleiserson]]

Comment on attachment 9565088 [details]
(secure)

Security Approval Request

• How easily could an exploit be constructed based on the patch?: Non-trivial. Claude's initial rewriting of the fuzz failure as a crash test broke it, so there's at least a little subtlety in creating a suitable image, and additional work would be required to turn the overrun into an exploit.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
• Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: all
• If not all supported branches, which bug introduced the flaw?: None
• Do you have backports for the affected branches?: No
• If not, how different, hard to create, and risky will they be?: Easy
• How likely is this patch to cause regressions; how much testing does it need?: Very safe
• Is the patch ready to land after security approval is given?: Yes
• Is Android affected?: Unknown

Comment 8

[Andy Leiserson [:aleiserson]]

The symptom here is a SIGILL from UBSan when an unsigned int that is indexing sequential memory access overflows. So there could be wild memory writes, but they're not well controlled.

Comment 9

[Lee Salzman [:lsalzman]]

Is this going to be submitted upstream to Cairo? Or otherwise noted as a patch in gfx/cairo for if/when we do update if we don't upstream this?

Comment 10

[Andy Leiserson [:aleiserson]]

I emailed Emmanuele Bassi last week, and he suggested filing a confidential bug in GitLab (which I did -- https://gitlab.freedesktop.org/cairo/cairo/-/work_items/939), and he also asked that we keep the issue confidential until the GNOME project had an opportunity to look at it, which is why I haven't landed the patch yet.

I believe :dholbert reached out to someone as well.

Comment 11

[BugBot [:suhaib / :marco]]

The bug is marked as tracked for firefox150 (beta) and tracked for firefox151 (nightly). However, the bug still has low priority.

:bhood, could you please increase the priority for this tracked bug? If you disagree with the tracking decision, please talk with the release managers.

For more information, please visit BugBot documentation.

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/f26d9e8cce76
https://hg.mozilla.org/integration/autoland/rev/61af0089efdc
Fix integer overflow in cairo PDF surface image emission r=gfx-reviewers,bradwerth

Comment 14

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/61af0089efdc

Comment 15

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:aleiserson, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox151 to wontfix.

For more information, please visit BugBot documentation.

Comment 16

[Donal Meehan [:dmeehan]]

To add to comment 15, please also add uplift requests for release, ESR140, and ESR115

Comment 17

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260428094204-3b3446e1079b.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 18

[Andy Leiserson [:aleiserson]]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D292028

Comment 19

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined/Reason for urgency: Security fix
• Code covered by automated testing?: no
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing: n/a
• Risk associated with taking this patch: low
• Explanation of risk level: Just changes some math to use unsigned long instead of int.
• String changes made/needed?: no
• Is Android affected?: unknown

Comment 20

[Phabricator Automation]

firefox-esr115 Uplift Approval Request

• User impact if declined/Reason for urgency: Security fix
• Code covered by automated testing?: no
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing: n/a
• Risk associated with taking this patch: low
• Explanation of risk level: Just changes some math to use unsigned long instead of int.
• String changes made/needed?: no
• Is Android affected?: unknown

Comment 21

[Andy Leiserson [:aleiserson]]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D292028

Comment 22

[Phabricator Automation]

firefox-esr140 Uplift Approval Request

• User impact if declined/Reason for urgency: Security fix
• Code covered by automated testing?: no
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing: n/a
• Risk associated with taking this patch: low
• Explanation of risk level: Just changes some math to use unsigned long instead of int.
• String changes made/needed?: no
• Is Android affected?: unknown

Comment 23

[Andy Leiserson [:aleiserson]]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D292028

Comment 24

[Phabricator Automation]

firefox-release Uplift Approval Request

• User impact if declined/Reason for urgency: Security fix
• Code covered by automated testing?: no
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing: n/a
• Risk associated with taking this patch: low
• Explanation of risk level: Just changes some math to use unsigned long instead of int.
• String changes made/needed?: no
• Is Android affected?: unknown

Comment 25

[Andy Leiserson [:aleiserson]]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D292028

Comment 26

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/bbfcce9906cc
https://hg.mozilla.org/releases/mozilla-beta/rev/eedefb565245

Comment 27

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/c7e256943493

Comment 28

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/ca55581cfb94

Comment 29

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/e05a9891f86d
https://hg.mozilla.org/releases/mozilla-release/rev/a534c758a90a

Comment 30

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/3f45ea272316

Comment 31

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/6b2f5b8aaf03