673808 - _CACHE_MAP_ is storing nsDiskCacheRecord structs with uninitialized data containing bits of Fx memory

Status: RESOLVED FIXED

(Core :: Networking: Cache, defect)

Description

[al_9x]

You should be able to find clusters of contiguous nsDiskCacheRecord structs whose mHashNumber is 0 and the other 12 bytes appear to be effectively a Fx memory dump of readable profile data (I've seen bookmarks jason, javascript)

Even though the data is full of 4 byte holes (mHashNumber), because the records are contiguous, the data is more or less readable. 

Fx should not be inadvertently storing potentially sensitive profile data in a totally unexpected location.

Comment 1

[Michal Novotny [:michal]]

Attachment: clear new uninitialized memory

Comment 2

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 548407 [details] [diff] [review]
clear new uninitialized memory

r=me

Comment 3

[Michal Novotny [:michal]]

Tryserver is green except few intermittent failures.

http://hg.mozilla.org/mozilla-central/rev/dd7d71277a15

Comment 4

[Boris Zbarsky [:bzbarsky]]

Please set the target milestone when checking things in....

Comment 5

[[e-mail]]

Comment on attachment 548407 [details] [diff] [review]
clear new uninitialized memory

>-        // Clear the new empty entries
>-        for (PRUint32 i = count; i < newRecordsPerBucket; ++i)
>-            newRecords[i].SetHashNumber(0);
I think this block is still necessary when newArray + bucketIndex * newRecordsPerBucket + i < mHeader.mRecordCount since these are old entries that are no longer used and may otherwise be confused with live entries.