449703 - [1.8 branch] XBM appears to draw uninitialized memory

Status: VERIFIED FIXED

(Core :: Graphics: ImageLib, defect)

Description

[Jesse Ruderman]

Attachment: testcase (XBM)

Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.16) Gecko/20080702 Firefox/2.0.0.16

Loading this XBM file makes Firefox 2 draw some random pixels.  They're different each time the image is reloaded, so it seems like Firefox might be displaying contents of uninitialized memory.

In Firefox 3 and trunk, I just see white, but I don't know whether the bug was really fixed (or whether it was fixed intentionally).

Billy Hoffman pointed this bug out during his talk at Black Hat today.

Comment 1

[Samuel Sidler (old account; do not CC)]

Vlad, can you find an owner for this?

Comment 2

[Daniel Veditz [:dveditz]]

It would be nice to plug this in the next FF2 update since it's public. probably a memset() is all it needs.

Comment 3

[:Gavin Sharp [email: [e-mail]]]

Presumably this was fixed on trunk by bug 376471?

Comment 4

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: potential fix?

I can't actually get 1.8.1 to build on my mac any more; this bug is OSX-only, right?  This is likely to fix it if so; if someone has a 1.8.1 build they could try this out on, that'd be helpful.

Comment 5

[Samuel Sidler (old account; do not CC)]

Comment on attachment 334923 [details] [diff] [review]
potential fix?

Dan, can you test this patch?

Comment 6

[Daniel Veditz [:dveditz]]

Well, yes, I can test the mac-only patch, but this is not a mac-only bug.

Comment 7

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Ah, I didn't realize it wasn't Mac-only -- I can test 1.8.1 on linux.

Comment 8

[Daniel Veditz [:dveditz]]

The patch didn't seem to work on the Mac. Did I not clobber enough?

Comment 9

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: fix

Looks like this buffer isn't being zero'd out if we happen to bail early.  Do so.

Comment 10

[Daniel Veditz [:dveditz]]

Comment on attachment 335439 [details] [diff] [review]
fix

Tested on Mac and Windows, r=dveditz

Approved for 1.8.1.17, a=dveditz for release-drivers.

Comment 11

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Checking in nsXBMDecoder.cpp;
/cvsroot/mozilla/modules/libpr0n/decoders/xbm/nsXBMDecoder.cpp,v  <--  nsXBMDecoder.cpp
new revision: 1.17.2.2; previous revision: 1.17.2.1
done

This doesn't seem to be present on trunk (and indeed, the offending code is gone from trunk -- memory allocation happens in a different spot).

Comment 12

[Al Billings [:abillings - ex-MoCo]]

Verified for 1.8.1.17 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.17) Gecko/2008082910 Firefox/2.0.0.17.

Comment 13

[Alexander Sack]

Comment on attachment 335439 [details] [diff] [review]
fix

a=asac for 1.8.0.15