Bug 623791 (CVE-2011-1302)

[ANGLE] WebGLES shader assertion failed: (oldhashloc >= 0), function IncreaseHashTableSize

RESOLVED FIXED

Status

()

defect
--
critical
RESOLVED FIXED
9 years ago
8 years ago

People

(Reporter: posidron, Assigned: bjacob)

Tracking

(Blocks 1 bug, {crash, testcase})

Trunk
x86_64
macOS
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(blocking2.0 Macaw+, status2.0 .1-fixed, status1.9.2 unaffected, status1.9.1 unaffected)

Details

(Whiteboard: [sg:critical?], )

Attachments

(2 attachments)

Reporter

Description

9 years ago
No description provided.
Reporter

Comment 1

9 years ago
Posted file callstack
Reporter

Comment 2

9 years ago
Posted file testcase

Comment 3

8 years ago
Can you please file this in the ANGLE issue tracker as well?  Thanks

Comment 4

8 years ago
We have fixed this issue in ANGLE revision 605.  Mozilla still crashes (under windows), but no longer in ANGLE code, so we expect that the validator must be statically compiled in and needs to be updated to verify this.
The upstream bug says

  A critical parser bug was fixed in r605. When loading the shader from a
  file, Chrome previously crashed but now properly reports the shader
  compilation failures.
  http://code.google.com/p/angleproject/issues/detail?id=117#c2

The patch fixes a buffer overflow
http://code.google.com/p/angleproject/source/detail?r=605

This was also fixed in Chrome so we need to get it into Macaw asap
Assignee: nobody → bjacob
Group: core-security
blocking2.0: --- → ?
status2.0: --- → wanted
Whiteboard: [sg:critical?]
blocking2.0: ? → Macaw+
Depends on: 646229
Chrome fixed an additional "off by three" overwrite in libGLESv2
http://code.google.com/p/angleproject/source/detail?r=611
Depends on: 649233
This will be fixed with the patches in bug 649233.
This landed on mozilla-central. Going to land these patches on mozilla-2.0 once they are approved in bug 649233.
Status: NEW → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → FIXED
Credit for the additional security fix the Chrome team reported to us (comment 6) should go to "yuri.ko616". It wasn't actually reported as a security issue, just a crash.
Alias: CVE-2011-0068
The additional fix for yuri.ko616's bug is tracked by Google at
http://code.google.com/p/chromium/issues/detail?id=70070 (hidden security bug)

Christophe's original bug is tracked by them at
http://code.google.com/p/chromium/issues/detail?id=78524

Announced (without detail) on 4/14 at
http://googlechromereleases.blogspot.com/2011/04/stable-channel-update.html

Comment 11

8 years ago
Actually, the guy wanted to be credited as "Yuri Ko"
I messed up in the Chrome release notes.
I was pinged for some additional information on why we landed the ANGLE updated the way we did.

The Chrome maintainers created a chrome_m10 branch in upstream ANGLE, and cherrypicked the changes they wanted. They branched off ANGLE r551, but the last time we updated was ANGLE r550. So, in order to stay 100% current with the chrome_m10 branch, we applied both r551 and r611, the two changesets that branch had that mozilla-central didn't have.
Group: core-security
Alias: CVE-2011-0068 → CVE-2011-1302
Updating the CVE number: the Chrome security team already assigned CVE-2011-1302 to Christophe's bug and MITRE has duped -0068 to that one.

Yuri's bug was CVE-2011-1300
I apologize for repeatedly misspelling Christoph's name.
Reporter

Comment 15

8 years ago
No problem. :)
Reporter

Updated

8 years ago
Blocks: 658170
You need to log in before you can comment on or make changes to this bug.