Closed
Bug 508860
Opened 16 years ago
Closed 16 years ago
Crash [@ nsCanvasRenderingContext2D::InitializeWithSurface]
Categories
(Core :: Graphics: Canvas2D, defect)
Tracking
()
RESOLVED
FIXED
mozilla1.9.3a1
| Tracking | Status | |
|---|---|---|
| status1.9.2 | --- | beta1-fixed |
People
(Reporter: jruderman, Assigned: robarnold)
References
Details
(Keywords: crash, testcase)
Crash Data
Attachments
(3 files)
Looks like nsCanvasRenderingContext2D::SetDimensions passes a null surface to nsCanvasRenderingContext2D::InitializeWithSurface, which doesn't know how to deal with that.
|
Reporter | |
Comment 1•16 years ago
|
||
Assignee: nobody → tellrob
Flags: blocking1.9.2+
|
||
Comment 3•16 years ago
|
||
afaict application NULL stuff is not exploitable on recent linux (unless the offset is higher than sys/vm/mmap_min_addr).
i have read that on arm architecture 0 is mmaped by default so this may be a problem on arm.
|
|
||
Comment 4•16 years ago
|
||
... i mean on recent i386/x86_64 linux
|
Assignee | |
Comment 5•16 years ago
|
||
This seems to fix the crash.
Attachment #393558 -
Flags: review?(vladimir)
|
|
Assignee | |
Updated•16 years ago
|
Status: NEW → ASSIGNED
Attachment #393558 -
Flags: review?(vladimir) → review+
Blocks: 515830
|
|
Assignee | |
Updated•16 years ago
|
Keywords: checkin-needed
|
||
Comment 6•16 years ago
|
||
Comment on attachment 393558 [details] [diff] [review]
v1.0
[Checkin: Comment 6 & 7]
http://hg.mozilla.org/mozilla-central/rev/bf607bae5e38
Attachment #393558 -
Attachment description: v1.0 → v1.0
[Checkin: Comment 6]
|
|
||
Updated•16 years ago
|
Status: ASSIGNED → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
Whiteboard: [c-n: m-1.9.2]
Target Milestone: --- → mozilla1.9.3a1
|
|
||
Comment 7•16 years ago
|
||
Comment on attachment 393558 [details] [diff] [review]
v1.0
[Checkin: Comment 6 & 7]
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/acf72836efcb
Attachment #393558 -
Attachment description: v1.0
[Checkin: Comment 6] → v1.0
[Checkin: Comment 6 & 7]
|
|
||
Updated•16 years ago
|
|
||
Updated•14 years ago
|
Crash Signature: [@ nsCanvasRenderingContext2D::InitializeWithSurface]
You need to log in
before you can comment on or make changes to this bug.
Description
•