Last Comment Bug 344960 - Crash [@ kernel32.dll CommonConstructor] with testcase using GeckoActiveXObject
: Crash [@ kernel32.dll CommonConstructor] with testcase using GeckoActiveXObject
Status: VERIFIED FIXED
[sg:low dos]
: crash, testcase, verified1.8.0.5, verified1.8.1
Product: Core
Classification: Components
Component: DOM (show other bugs)
: Trunk
: x86 Windows XP
: -- critical (vote)
: ---
Assigned To: general
: Hixie (not reading bugmail)
Mentors:
: 344957 (view as bug list)
Depends on:
Blocks: 344950
  Show dependency treegraph
 
Reported: 2006-07-17 13:06 PDT by Martijn Wargers [:mwargers] (not working for Mozilla)
Modified: 2009-04-02 22:44 PDT (History)
7 users (show)
mconnor: blocking1.8.1+
dveditz: blocking1.8.0.5+
dveditz: in‑testsuite?
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (380 bytes, text/html)
2006-07-17 13:08 PDT, Martijn Wargers [:mwargers] (not working for Mozilla)
no flags Details
testcase (380 bytes, text/html)
2006-07-17 13:11 PDT, Martijn Wargers [:mwargers] (not working for Mozilla)
no flags Details
Fix (by capping the argument length). (2.41 KB, patch)
2006-07-17 15:39 PDT, Johnny Stenback (:jst, jst@mozilla.com)
mrbkap: review+
jonas: superreview+
dveditz: approval1.8.0.5+
dbaron: approval1.8.1+
Details | Diff | Review

Description Martijn Wargers [:mwargers] (not working for Mozilla) 2006-07-17 13:06:34 PDT
See upcoming testcase, this crashes Firefox1.5.0.5RC3 and current trunk builds.
Current trunk builds probably crash already earlier because of bug 344957.

Talkback ID: TB21052037Q
kernel32.dll + 0x1eb33 (0x7c81eb33)
_CxxThrowException
_com_error::_com_error
_com_issue_error
CommonConstructor  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/XPCIDispatchExtension.cpp, line 90]
ActiveXConstructor  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/XPCIDispatchExtension.cpp, line 131]
js_Invoke  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1188]
js_Interpret  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3584]
js_Invoke  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1208]
js_InternalInvoke  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1285]
JS_CallFunctionValue  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 4177]
nsJSContext::CallEventHandler  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1411]
nsJSEventListener::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/dom/src/events/nsJSEventListener.cpp, line 195]
nsEventListenerManager::HandleEventSubType  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1687]
nsEventListenerManager::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1788]
nsGenericElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 2185]
nsHTMLButtonElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/html/content/src/nsHTMLButtonElement.cpp, line 336]
PresShell::HandleEventInternal  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6379]
PresShell::HandleEventWithTarget  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6277]
nsEventStateManager::CheckForAndDispatchClick  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/events/src/nsEventStateManager.cpp, line 3048]
nsEventStateManager::PostHandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/events/src/nsEventStateManager.cpp, line 2026]
PresShell::HandleEventInternal  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6451]
PresShell::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6215]
nsViewManager::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 2559]
nsViewManager::DispatchEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 2246]
HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1258]
nsWindow::DispatchMouseEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 6028]
ChildWindow::DispatchMouseEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 6279]
nsWindow::WindowProc  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1440]
USER32.dll + 0x8734 (0x77d18734)
USER32.dll + 0x8816 (0x77d18816)
USER32.dll + 0x89cd (0x77d189cd)
USER32.dll + 0x8a10 (0x77d18a10)
nsAppShell::Run  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsAppShell.cpp, line 159]
nsAppStartup::Run  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 151]
main  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61]
kernel32.dll + 0x16d4f (0x7c816d4f)
Comment 1 Martijn Wargers [:mwargers] (not working for Mozilla) 2006-07-17 13:08:53 PDT
Created attachment 229524 [details]
testcase

The testcase triggers some kind of oom situation, after GeckoActiveXObject crashes.
Comment 2 Martijn Wargers [:mwargers] (not working for Mozilla) 2006-07-17 13:11:13 PDT
Created attachment 229526 [details]
testcase

Correct testcase, that actually crashes this time.
Comment 3 Johnny Stenback (:jst, jst@mozilla.com) 2006-07-17 15:39:41 PDT
Created attachment 229565 [details] [diff] [review]
Fix (by capping the argument length).

Cap the constructor argument length at 2k to keep windows string code from crashing (due to OOM). This also fixes a bug where we were incorrectly protecting against an empty string argument (null checked the wrong variable).
Comment 4 Johnny Stenback (:jst, jst@mozilla.com) 2006-07-18 12:58:13 PDT
Potentially exploitable security bug (Win32 only), nominating for branches. Fixed on trunk.
Comment 5 Daniel Veditz [:dveditz] 2006-07-18 14:23:11 PDT
Since we're respinning, and this is based on a semi-public fuzz tester, seems better to take a safe fix now than wait.
Comment 6 Daniel Veditz [:dveditz] 2006-07-18 14:24:41 PDT
Comment on attachment 229565 [details] [diff] [review]
Fix (by capping the argument length).

approved for 1.8.0 branch, a=dveditz for drivers.

Please land today.
Comment 7 Blake Kaplan (:mrbkap) (please use needinfo!) 2006-07-19 01:56:05 PDT
*** Bug 344957 has been marked as a duplicate of this bug. ***
Comment 8 Jay Patel [:jay] 2006-07-19 19:20:00 PDT
v.fixed on 1.8.0 branch with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.5) Gecko/20060719 Firefox/1.5.0.5, no crash with rc4 build (did crash with rc3).
Comment 9 Martijn Wargers [:mwargers] (not working for Mozilla) 2006-07-23 08:27:39 PDT
Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060721 Minefield/3.0a1
Comment 10 Bob Clary [:bc:] 2006-08-22 10:48:20 PDT
https://bugzilla.mozilla.org/attachment.cgi?id=229526
ff2b2 debug/nightly windows/linux no crash
verified fixed 1.8
Comment 11 Bob Clary [:bc:] 2009-03-31 21:31:02 PDT
GeckoActiveXObject is no longer built by default on 1.9.0 and later right?
Comment 12 Daniel Veditz [:dveditz] 2009-04-02 22:44:46 PDT
I don't know if it _works_, but GeckoActiveXObject still exists on windows builds of 1.9.0 and 1.9.1 and XPC_IDISPATCH_SUPPORT is enabled in the build.

Note You need to log in before you can comment on or make changes to this bug.