454345 - Crash [@ BuildTextRunsScanner::BreakSink::SetBreaks], with really large word-spacing value

Status: RESOLVED WORKSFORME

(Core :: Layout: Text and Fonts, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Usually crashes dereferencing 0xc000000b, so it could be exploitable (note the leading digit 'c').

Comment 1

[Daniel Veditz [:dveditz]]

Does not affect Firefox 2/Gecko 1.8.1.x

I did not crash on Firefox 3.0.x, but I got several worrying assertions:

###!!! ASSERTION: nscoord subtraction will reach or pass nscoord_MIN: '(PRInt64)a - (PRInt64)b > (PRInt64)nscoord_MIN', file ../../dist/include/gfx\nsCoord.h, line 211
###!!! ASSERTION: NSCoordSaturatingSubtract got nscoord_MIN as argument: 'a != nscoord_MIN && b != nscoord_MIN', file ../../dist/include/gfx\nsCoord.h, line 187
###!!! ASSERTION: nscoord subtraction will reach or pass nscoord_MIN: '(PRInt64)a - (PRInt64)b > (PRInt64)nscoord_MIN', file ../../dist/include/gfx\nsCoord.h, line 211
###!!! ASSERTION: NSCoordSaturatingSubtract got nscoord_MIN as argument: 'a != nscoord_MIN && b != nscoord_MIN', file ../../dist/include/gfx\nsCoord.h, line 187
###!!! ASSERTION: nscoord subtraction will reach or pass nscoord_MIN: '(PRInt64)a - (PRInt64)b > (PRInt64)nscoord_MIN', file ../../dist/include/gfx\nsCoord.h, line 211
###!!! ASSERTION: NSCoordSaturatingSubtract got nscoord_MIN as argument: 'a != nscoord_MIN && b != nscoord_MIN', file ../../dist/include/gfx\nsCoord.h, line 187
###!!! ASSERTION: nscoord subtraction will reach or pass nscoord_MIN: '(PRInt64)a - (PRInt64)b > (PRInt64)nscoord_MIN', file ../../dist/include/gfx\nsCoord.h, line 211

Comment 2

[Lucas Adamski [:ladamski]]

I can't get this to repro either.  But marking [sg:critical?] for now until we figure out repro issues.

Comment 3

[Jesse Ruderman]

Still crashes for me on trunk.

Doesn't crash for me on 3.0.x.  I don't find those assertions especially worrying, since they indicate problems with widths and heights rather than with pointers.

Comment 4

[Daniel Holbert [:dholbert]]

Testcase crashes for me on my Linux mozilla-central debug build, after a bunch of "nscoord addition/subtraction will reach or pass nscoord_MIN" assertion failures.

Platform --> All/All

Comment 5

[Daniel Holbert [:dholbert]]

Attachment: backtrace of crash on Linux

Here's a backtrace of my crash on Linux.

The lowest level, nsTextFrameThebes.cpp:699, is:
699         if (mTextRun->SetPotentialLineBreaks( [SNIP]

and at that point, mTextRun points to already-deleted data, so we crash. (When I print its contents, I get lots of 0x5a5a5a5a pointers)

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

Can't reproduce on 64bit linux trunk, but 1.9.1 still crashes.
32 bit linux trunk is ok, so is OSX trunk.
So maybe the branch is just missing some patch.

Might be useful to find what has fixed this.

Comment 7

[Martijn Wargers (dead)]

The testcase doesn't crash for me at all, when using the older builds, starting from 2008-09-08, nor using the latest1.9.1 build. This is on windows.

Comment 8

[Jesse Ruderman]

WFM.