360645 - Firefox 2.0 SVG "_cairo_pen_init" Heap Overflow

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Tom Ferris]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.9a1) Gecko/20061113 Minefield/3.0a1
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.9a1) Gecko/20061113 Minefield/3.0a1

Firefox 2.0 SVG "_cairo_pen_init" Heap Overflow

Versions Affected:
Firefox 2.0

Platforms Affected:
Apple Mac OSX 10.4 and prior
Windows XP
Linux

Overview:
When processing a specially crafted .svg file, this will cause firefox to crash.  This allows for an attacker to cause firefox to crash, and or to execute arbitrary code (probably a tough one) on a targeted host.

Technical Details:
The following SVG code below will reproduce this issue:

		<clipPath  stroke-width="2000000000000000" color="1" >
			<line>
			</line>
		</clipPath>

Below is the crash when running firefox within gdb on OSX 10.4.7

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x45b4f010
0x007d62c5 in _cairo_pen_init ()
(gdb) bt
#0  0x007d62c5 in _cairo_pen_init ()
#1  0x00712635 in _cairo_gstate_stroke_extents ()
#2  0x0050e219 in cairo_stroke_extents ()
#3  0x004f30b0 in nsSVGCairoPathGeometry::GetCoveredRegion ()
#4  0x004f324d in nsSVGCairoPathGeometry::Update ()
#5  0x007ae1bc in nsSVGPathGeometryFrame::UpdateGraphic ()
#6  0x007ae3f2 in nsSVGPathGeometryFrame::NotifyRedrawUnsuspended ()
#7  0x006529ab in nsSVGDefsFrame::NotifyRedrawUnsuspended ()
#8  0x0069abee in nsSVGOuterSVGFrame::UnsuspendRedraw ()
#9  0x0069b121 in nsSVGOuterSVGFrame::DidReflow ()
#10 0x0063f84f in CanvasFrame::Reflow ()
#11 0x0044a58c in nsContainerFrame::ReflowChild ()
#12 0x00680234 in nsHTMLScrollFrame::ReflowScrolledFrame ()
#13 0x0068040a in nsHTMLScrollFrame::ReflowContents ()
#14 0x006820fe in nsHTMLScrollFrame::Reflow ()

-- snip --






Reproducible: Always

Comment 1

[Tom Ferris]

Attachment: testcase

Comment 2

[chris hofmann]

Tom,  we should start out these SVG bugs with assignment to product=core component=svg  

user agent shows trunk.  is this trunk and firefox 2.0?

thanks

Comment 3

[Tom Ferris]

(In reply to comment #2)
> Tom,  we should start out these SVG bugs with assignment to product=core
> component=svg  
> 
> user agent shows trunk.  is this trunk and firefox 2.0?
> 
> thanks
> 

Hi Chris,

When I initially filed the bug, I wasn't able to select Core/SVG.  Also, this affects 2.0 and not 3.0.  Sorry for the user agent confusion.

Comment 4

[Daniel Veditz [:dveditz]]

FF 1.5.0.8 does not crash (on windows). FF2 and 2.0.0.1 do.

Comment 5

[Daniel Veditz [:dveditz]]

TB27170889 (FF2.0)
TB27171253 (FF2.0.0.1 rc1)

Same stacks as comment 0

Comment 6

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Easiest way to fix this is to clamp the final pen stroke width; do any SVG folks have an idea of an appropriate value?

Comment 7

[Carl Worth]

(In reply to comment #6)
> Easiest way to fix this is to clamp the final pen stroke width; do any SVG
> folks have an idea of an appropriate value?

Without reference to the SVG specification or anything, I would guess that
as soon as the stroke width is more than 2 (or 10 or whatever) times the
window size or so that there can't be anything all that useful being displayed
anymore.

Comment 8

[Tom Ferris]

yeah, I think that 5 times the window size is sufficient.. 

Comment 9

[Jay Patel [:jay]]

Vlad:  Could you whip up a patch with the recommended value from Tom?  If not, please find a new owner (maybe tor can help?)

Comment 10

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

The problem is that we have no way of getting the window size from anywhere near that code; tor would probably be a better owner for this, if it needs to be fixed at a higher level than that.  I was thinking of clamping to some hardcoded value like 8192 (which, really, will be greater than 5* most people's window sizes).

Comment 11

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: clamp the num_vertices to a sane value

This fixes the problem; I don't /think/ it will cause any other svg problems -- I clam to 64k vertices for the pen, which should be more than enough for most sane uses.

Comment 12

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Comment on attachment 251677 [details] [diff] [review]
clamp the num_vertices to a sane value

Low impact, shouldn't break anything.

Comment 13

[Jay Patel [:jay]]

Comment on attachment 251677 [details] [diff] [review]
clamp the num_vertices to a sane value

Approved for 1.8 branch, a=jay for drivers.

Comment 14

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Checked in to 1.8 branch.

Comment 15

[alice nodelman [:alice] [:anode]]

Using provided testcase confirmed existence of bug on 2.0.0.1.

Verified fixed for 2.0.0.2pre - testcase runs and does not crash.

Build identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.2pre) Gecko/2007013007 BonEcho/2.0.0.2pre

Comment 19

[Daniel Veditz [:dveditz]]

Filed bug 372193 on the new issue noted in comment 16-18

Comment 20

[Daniel Veditz [:dveditz]]

Don't know where I got that bug number. It's really bug 372285