548002 - Blocklist old versions of Acrobat Reader due to crashes [@ UserCallWinProcCheckWow]

Status: RESOLVED WORKSFORME

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Henrik Skupin [:whimboo][⌚️UTC+2]]

With bug 531551 we track the #1 topcrasher for Firefox 3.6. As David Baron proposed over there this bug should handle the blocklist work for the Plugin.

David, which versions should be blocked in detail? Are those only the following or all releases of 8.1 and 9.0?

19% (837/4360) vs.   1% (1200/97654) 8.1.0.137 
14% (631/4360) vs.   1% (919/97654) 8.1.3.187
16% (695/4360) vs.   1% (1287/97654) 9.0.0.332

Comment 1

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Chris, would you have time to check which versions of Acrobat reader should be blocklisted?

Comment 2

[chris hofmann]

as mentioned in https://bugzilla.mozilla.org/show_bug.cgi?id=524460 we can't do good version check against acrobat since they haven't been updating the version info after critical security updates.  

adobe plans to start doing this with the next release.  after that we should be able to block old versions.

Comment 3

[Damon Sicore (:damons)]

Are there identifiable and unique older DLLs that we can block?

Comment 4

[chris hofmann]

I'm seeing about 200-270 crashes per day from https://qtwu2.turbotaxonline.intuit.com/secure/ttonline.htm , turbotax.intuit.com and turbotax.com with this stack signature  and general users comments about what looks like pdf interaction to view and print out US tax returns.  I think there might be several parts of their tax filing app that might tickle pdf interaction bugs.

an example is

https://qtwu2.turbotaxonline.intuit.com/tto-web/ttaxol/TaxReturn.pdf?cr=printType%3D1%26returnType%3D2%26miniwks%3Dfalse%26watermark%3Dfalse&cmd=PRINT&uid=XXXXXXXXX%3A0&prodid=512
&csrc=3468337910&app=ttwprodapp22&pt=63770&D=TaxReturn.pdf 

UserCallWinProcCheckWow
http://crash-stats.mozilla.com/report/index/52bcce39-98db-4d78-ba24-8b63a2100328

I suspect volume on this could increase as the April 15th tax filing deadline in the US approaches.

I can't think of any ideas other than maybe getting intuit to publish warnings about installing the latest version of acrobat before starting the filing process.   maybe we can also contact them to see if there is a way create reproducible test cases with the pdf interaction.

Comment 5

[chris hofmann]

In general the UserCallWinProcCheckWow are mostly 3.6.x.

checking --- 20100328-crashdata.csv UserCallWinProcCheckWow
release total-crashes
              UserCallWinProcCheckWow crashes

3.5.8   34753   271     0.00779789
3.0.18  10964   91      0.00829989
3.6.2  212098  10906   0.0514196

that seems to hold up for these turbotax UserCallWinProcCheckWow crashes.  about 99% of them are 3.6 or 3.6.2.

Comment 6

[chris hofmann]

oops, I guess comment 4 and 5 should go over in bug 531551, not this bug to block list.

Comment 7

[chris hofmann]

old versions of reader could be blocked now since the latest update has proper version info

http://www.adobe.com/support/security/bulletins/apsb10-09.html 

Version 9.3.2 of Reader now includes 9.3.2 in the name and this will be updated
for each new version.
Version 8.2.2 of Reader now includes 8.2.2 in the name and will be updated for
each new version.

maybe start with soft blocking of all versions earlier than these and see if we can get people moving.

Comment 8

[Marie-Eve]

Attachment: bug 548002

Comment 10

[Wayne Mery (:wsmwk)]

(In reply to comment #7)
>
> maybe start with soft blocking of all versions earlier than these and see if we
> can get people moving.

is blocklisting still on the table?
~#70 crash for thunderbird 3.0.6

Comment 11

[Robert Kaiser]

If so, please do the same for SeaMonkey, this signature is the #1 topcrash for newly released SeaMonkey 2.0.8 (even though it does not have a very high count - I guess we are just very stable now).

Comment 12

[Bob Clary [:bc] (inactive)]

UserCallWinProcCheckWow is the top crash for 3.6. Can we get the block list in place for older versions of Acrobat and see how it affects the relative placement and frequency of this signature? Seems a rather large potential return for little investment.

Comment 13

[yeren]

I guess a blocklist wouldn't help, because Firefox crashes on the latest versions of the Acrobat plugin, not on the old ones. older 8.x plugins are working fine, but who wants to use them..? The problem is big enough that I turned away from Firefox to Chrome where I can use the internal pdf viewer instead of the Acrobat plugin and thus avoid the crashes.

Comment 14

[Scoobidiver (away)]

There's a spike in crashes from 15.0a1/20120503: https://crash-stats.mozilla.com/report/list?product=Firefox&version=Firefox%3A15.0a1&query_search=signature&query_type=contains&reason_type=contains&range_value=28&range_unit=days&do_query=1&signature=UserCallWinProcCheckWow

It's still correlated to old versions of Acrobat Reader:
* 5/6:
  UserCallWinProcCheckWow|EXCEPTION_ACCESS_VIOLATION_EXEC (12 crashes)
     67% (8/12) vs.   1% (14/2762) nppdf32.dll
         25% (3/12) vs.   0% (3/2762) 6.0.0.878
          8% (1/12) vs.   0% (1/2762) 7.0.0.0
         33% (4/12) vs.   0% (6/2762) 9.0.0.332
* 5/8:
  UserCallWinProcCheckWow|EXCEPTION_ACCESS_VIOLATION_EXEC (20 crashes)
     60% (12/20) vs.   1% (35/2624) nppdf32.dll
         20% (4/20) vs.   0% (7/2624) 7.0.0.0
         10% (2/20) vs.   0% (2/2624) 8.0.0.456
          5% (1/20) vs.   0% (1/2624) 8.1.0.137
         25% (5/20) vs.   0% (12/2624) 9.0.0.332

Comment 15

[Jorge Villalobos [:jorgev] (he/him)]

As far as I can see, the current blocks cover these crashy versions.

https://wiki.mozilla.org/Blocklisting/PluginBlocks