588929 - (CVE-2010-3180) Use after free - nsBarProp

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Sergey Glazunov]

Reproduced on 4.0b5pre and 3.6.8.
The repro contains this:

  w = open(1, 1, 1);
  o = w.locationbar;
  w.close();
  
  s = '';
  setInterval('s += o.visible', 50);

http://crash-stats.mozilla.com/report/index/1b83dc24-cdb7-4435-838d-643822100819

Comment 1

[Sergey Glazunov]

Attachment: testcase

Comment 2

[chris hofmann]

this signature shows up in the wild around 10-25 times a day as well.
mostly with people on http://www.hulu.com/watch and a few video sites.  I mostly see this on 3.6.x releases where active daily user are 1 million+


http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=contains&query=nsBarProp%3A%3AGetVisibleByFlag&date=08%2F19%2F2010%2013%3A43%3A59&range_value=1&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=nsBarProp%3A%3AGetVisibleByFlag%28int*%2C%20unsigned%20int%29

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Just FYI, this is a "regression" from <[e-mail]> 2000-02-08 05:38.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Attachment: patch

This is the simplest fix I could think of. And better to make those
nsBarProp methods not throw.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Other, not quite as simple would be to have a weak reference (not raw) to
DOMWindow, and get browserchrome from it.

Comment 6

[Martijn Wargers (dead)]

Is this related to bug 575102?

Comment 7

[LegNeato]

If this gets reviewed and can land today it will make 3.6.9/3.5.12. If not, it will have to wait for the next release. Please ask for landing approval when/if it gets ready today. Thanks!

Comment 8

[Olli Pettay [:smaug][[e-mail]]]

http://hg.mozilla.org/mozilla-central/rev/7de93c31c0f2

Comment 9

[Olli Pettay [:smaug][[e-mail]]]

Attachment: for 1.9.2

Comment 10

[Olli Pettay [:smaug][[e-mail]]]

Attachment: for 1.9.1

Comment 11

[Daniel Veditz [:dveditz]]

Comment on attachment 475069 [details] [diff] [review]
for 1.9.2

Approved for 1.9.2.11, a=dveditz for release-drivers

Comment 12

[Daniel Veditz [:dveditz]]

Comment on attachment 475070 [details] [diff] [review]
for 1.9.1

Approved for 1.9.1.14, a=dveditz for release-drivers

Comment 13

[Olli Pettay [:smaug][[e-mail]]]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/fad1fb5ed6c0
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/5f928f65382d