265067 - potential heap overflow found by mangler.cgi

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[georgi - hopefully not receiving bugspam]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; rv:1.7.3) Gecko/20040914 Firefox/0.10
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; rv:1.7.3) Gecko/20040914 Firefox/0.10

after running mangler.cgi for some time, a crash which looks like heap overflow
was found in firefox (don't have debug version of firefox and mozilla seems not
affected).

will attach the testcase.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1085497312 (LWP 13323)]
0x4095d51c in mallopt () from /lib/tls/libc.so.6
(gdb) x/i $eip
0x4095d51c <mallopt+28>:        call   0x408fd78f
(gdb) info stack
#0  0x4095d51c in mallopt () from /lib/tls/libc.so.6
#1  0x4095e1c5 in mallopt () from /lib/tls/libc.so.6
#2  0x4095ba13 in realloc () from /lib/tls/libc.so.6
#3  0x4054c313 in g_realloc () from /usr/lib/libglib-2.0.so.0


Reproducible: Always
Steps to Reproduce:
check the testcase.

Actual Results:  
crash

Expected Results:  
no crash

Comment 1

[georgi - hopefully not receiving bugspam]

Attachment: crash in mallopt

Comment 2

[Daniel Veditz [:dveditz]]

confirming

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Doesn't crash for me (Linux).

Comment 4

[Daniel Veditz [:dveditz]]

This no longer crashes for me on Windows with the 1.0 release. Can we chalk this
up to a dupe of one of the other mangler bugs that got fixed? Georgi, can you
still reproduce this?

Comment 5

[georgi - hopefully not receiving bugspam]

crashes firefox 1.0 release on linux for me.

Comment 6

[georgi - hopefully not receiving bugspam]

nightly Gecko/20050107 on linux does NOT crash.

Comment 7

[Bernd]

Georgi could you test a recent aviary 1.0.1 build, wfm on windows.

Comment 8

[georgi - hopefully not receiving bugspam]

Still CRASHES: 
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20050213 Firefox/1.0
(downloaded from latest-aviary1.0.1/ )
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1086063520 (LWP 5648)]
0x409c047c in mallopt () from /lib/tls/libc.so.6
(gdb) info stack
#0  0x409c047c in mallopt () from /lib/tls/libc.so.6
#1  0x409beaf9 in malloc () from /lib/tls/libc.so.6
#2  0x405c4067 in g_malloc () from /usr/lib/libglib-2.0.so.0
#3  0x00000020 in ?? ()
#4  0x00000000 in ?? ()
#5  0x00000000 in ?? ()
#6  0x00000000 in ?? ()
#7  0x00000000 in ?? ()
#8  0x404d8f98 in ?? () from /usr/lib/libgdk-x11-2.0.so.0
#9  0x0902ef08 in ?? ()
#10 0x4048e648 in gdk_region_offset () from /usr/lib/libgdk-x11-2.0.so.0
#11 0x00000010 in ?? ()
#12 0xbf8000dc in ?? ()
#13 0x409beaf9 in malloc () from /lib/tls/libc.so.6
Previous frame inner to this frame (corrupt stack?)



Does NOT crash on:
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8a6) Gecko/20050107 Firefox/1.0+

Comment 9

[Boris Zbarsky [:bzbarsky]]

It looks like this got fixed on trunk between 2004-10-11-08 and 2004-10-12-08. 
Bonsai URL:

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2004-10-11+05%3A00%3A00&maxdate=2004-10-12+08%3A00%3A00&cvsroot=%2Fcvsroot

Nothing obvious jumps out at me.

Comment 10

[Daniel Veditz [:dveditz]]

Roc's changes for bug 238493 have a linux-only component. Is FF built using gtk2?

Or maybe your fix for bug 263569 changed the memory allocation pattern enough to
sidestep some landmine in libc? You're right, if that's the real fix window
there's nothing obvious.

Comment 11

[Boris Zbarsky [:bzbarsky]]

FF is built with GTK2, but that fix window is using GTK1 SeaMonkey trunk nightlies.

Comment 12

[georgi - hopefully not receiving bugspam]

since it is not worth fixing in 1.0.1 for linux removing security flag.

Comment 13

[georgi - hopefully not receiving bugspam]

probably this is invalid and the problem is in my box.

does not crash on another box with ff 1.0.1

Comment 14

[georgi - hopefully not receiving bugspam]

does not crash on firefox 1.0.1 built from source.

Comment 15

[Jason Bassford]

Nothing was checked, no bug / patch mentioned as the fix.

-> WORKSFORME