Closed Bug 348644 Opened 20 years ago Closed 19 years ago

Crash [@ _cairo_win32_surface_create_similar_internal] with image testcase that keeps changing image url

Categories

(Core :: Graphics, defect)

Product:
Core
Component:
Graphics
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: martijn.martijn, Unassigned)

References

Details

(Keywords: crash, regression, testcase, Whiteboard: [sg:nse dos] post 1.8-branch)

Crash Data

Attachments

(2 files, 1 obsolete file)

testcase
3.37 KB, text/html
Details
backtrace
2.31 KB, text/plain
Details
See upcoming testcase, that reliably crashes my trunk build when the counter in the status bar has reached 2155. This regressed between 2006-08-09 and 2006-08-10, I think a regression from bug 343655. Talkback ID: TB22089223W _cairo_win32_surface_create_similar_internal _cairo_win32_surface_create_similar_internal _cairo_surface_composite_shape_fixup_unbounded _moz_cairo_surface_create_similar _moz_cairo_push_group_with_content gfxContext::DrawTextRun
Attached file testcase (obsolete) —
Attached file testcase —
Attachment #233617 - Attachment is obsolete: true
Depends on: 359589
can you trace through and answer owen taylor's question from https://bugs.freedesktop.org/show_bug.cgi?id=8829#c4 ?
Attached file backtrace —
Well, this is a backtrace of a debug build, if that's what you wanted.
Flags: blocking1.9?
Flags: blocking1.9? → blocking1.9+
Ok, doesn't crash anymore, using: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a4pre) Gecko/20070403 Minefield/3.0a4pre Apparently fixed by bug 374272.
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → FIXED
Martijn: this bug can be opened now, right?
Whiteboard: post 1.8-branch
Sure, fine by me.
Group: security
Flags: wanted1.8.1.x-
Please correct sg: marking if incorrect, looks like from bug 374272 this is just a DoS by exhausting GDI and not exploitable.
Whiteboard: post 1.8-branch → [sg:nse dos] post 1.8-branch
verified fixed using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9b3pre) Gecko/2008010104 Minefield/3.0b3pre ID:2008010104 and the testcase. No Crash on testcase - changing bug to verified
Status: RESOLVED → VERIFIED
With today nightly (2008040106 Fx3.0pre) I encounter crash with similar stack: http://crash-stats.mozilla.com/report/index/f9d4aefd-0001-11dd-b1e3-001a4bd43ef6 Entered as bug 426369.
Crash Signature: [@ _cairo_win32_surface_create_similar_internal]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: