393832 - (CVE-2009-1827) svg circle with infinite radius causes hang

Status: VERIFIED FIXED

(Core :: SVG, defect)

Description

[georgi - hopefully not receiving bugspam]

Attachment: svg circle

svg circle with infinite radius causes hang

<circle cx="100" cy="100" r="200E200" /> 
causes
_cairo_arc_in_direction (cr=0x8e3a560, xc=100, yc=100, 
    radius=inf, angle_min=0, angle_max=3.1415926535897931, 

this is kind of dos

(gdb) bt
#0  0xb74c3bd6 in sin () from /lib/i686/libm.so.6
#1  0xb6223915 in _arc_error_normalized (angle=1.6922030997455189e-07)
    at /opt/joro/firefox-cvs/mozilla/gfx/cairo/cairo/src/cairo-arc.c:64
#2  0xb6223a21 in _arc_max_angle_for_tolerance_normalized (tolerance=0)
    at /opt/joro/firefox-cvs/mozilla/gfx/cairo/cairo/src/cairo-arc.c:99
#3  0xb6223aa7 in _arc_segments_needed (angle=3.1415926535897931, radius=inf, 
    ctm=0xbf9c5620, tolerance=0.10000000000000001)
    at /opt/joro/firefox-cvs/mozilla/gfx/cairo/cairo/src/cairo-arc.c:117
#4  0xb6223dca in _cairo_arc_in_direction (cr=0x8e3a560, xc=100, yc=100, 
    radius=inf, angle_min=0, angle_max=3.1415926535897931, 
    dir=CAIRO_DIRECTION_FORWARD)
    at /opt/joro/firefox-cvs/mozilla/gfx/cairo/cairo/src/cairo-arc.c:214
#5  0xb6223ce2 in _cairo_arc_in_direction (cr=0x8e3a560, xc=100, yc=100, 
    radius=inf, angle_min=0, angle_max=6.2831853071795862, 
    dir=CAIRO_DIRECTION_FORWARD)
    at /opt/joro/firefox-cvs/mozilla/gfx/cairo/cairo/src/cairo-arc.c:192
#6  0xb6223ec3 in _cairo_arc_path (cr=0x8e3a560, xc=100, yc=100, radius=inf, 
    angle1=0, angle2=6.2831853071795862)
    at /opt/joro/firefox-cvs/mozilla/gfx/cairo/cairo/src/cairo-arc.c:256
#7  0xb6221e81 in _moz_cairo_arc (cr=0x8e3a560, xc=100, yc=100, radius=inf, 
    angle1=0, angle2=6.2831853071795862)
    at /opt/joro/firefox-cvs/mozilla/gfx/cairo/cairo/src/cairo.c:1578
#8  0xb61ff54c in gfxContext::Arc (this=0xbf9c5974, center=@0xbf9c58b0,
(gdb) next
_arc_max_angle_for_tolerance_normalized (tolerance=0)
    at /opt/joro/firefox-cvs/mozilla/gfx/cairo/cairo/src/cairo-arc.c:100
100         } while (error > tolerance);
(gdb) p error
$1 = 4.246402931726046e-46
(gdb) p tolerance
$2 = 0
(gdb)

Comment 1

[Ria Klaassen (not reading all bugmail)]

Regression range is http://bonsai.mozilla.org/cvsquery.cgi?module=PhoenixTinderbox&date=explicit&mindate=2006-05-01+02%3A00&maxdate=2006-05-01+22%3A00
and seems to points to bug 334999.

Comment 2

[georgi - hopefully not receiving bugspam]

[sg:nse] [sg:dos?]

Comment 4

[Robert Longson [:longsonr]]

Attachment: patch

Comment 5

[Jonathan Watt [:jwatt]]

Comment on attachment 379974 [details] [diff] [review]
patch

nice. r=jwatt

Comment 6

[Robert Longson [:longsonr]]

checked in http://hg.mozilla.org/mozilla-central/rev/0aea8ddb0189

Comment 7

[Craig Topper]

Did this miss fixing nsSVGLength? Looks like Length2 was fixed and both SVGNumber and SVGNumber2, but no SVGLength.

Comment 8

[Robert Longson [:longsonr]]

I guess I missed it becasue it doesn't immediately cast the strtod result. Needs another bug raised to fix.

Comment 9

[Daniel Veditz [:dveditz]]

Filed bug 503601

Comment 10

[georgi - hopefully not receiving bugspam]

afaict the patch checks for *parsing* FP infinity.

|inf| can result from arithmetic operations:

char st[]="10E250";
double d,r;
char *endptr;
d=strtod(st,&endptr); /* != inf */
r=d*d; /* == inf */

Comment 11

[Robert Longson [:longsonr]]

If you see anywhere that occurs in the codebase then raise another bug for it.

Comment 12

[Samuel Sidler (old account; do not CC)]

Is this ready for 1.9.1.1? Can you please request approval for 1.9.1.1 on a patch that applies?

Comment 13

[Robert Longson [:longsonr]]

Attachment: 1.9.1 patch

Comment 14

[Robert Longson [:longsonr]]

Note that the 1.9.1 patch includes the bug 501311 nsSVGLength change

Comment 15

[Samuel Sidler (old account; do not CC)]

Comment on attachment 388419 [details] [diff] [review]
1.9.1 patch

Approved for 1.9.1.2. a=ss for release-drivers

Can you be sure to get a test written for this as well?

Comment 16

[Robert Longson [:longsonr]]

The first attachment could be checked into layout/svg/crashtests/393832.svg as a crashtest.

Comment 17

[Joe Drew (not getting mail)]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/131947ecddd4

Any testcases will have to go in separately, though.

Comment 18

[Kevin Brosnan]

Verified

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2a1pre) Gecko/20090730 Minefield/3.6a1pre