Last Comment Bug 673808 - _CACHE_MAP_ is storing nsDiskCacheRecord structs with uninitialized data containing bits of Fx memory
: _CACHE_MAP_ is storing nsDiskCacheRecord structs with uninitialized data cont...
Status: RESOLVED FIXED
[sg:low local]
:
Product: Core
Classification: Components
Component: Networking: Cache (show other bugs)
: 5 Branch
: x86 Windows XP
: -- normal (vote)
: mozilla8
Assigned To: Nobody; OK to take it and work on it
:
: Patrick McManus [:mcmanus]
Mentors:
Depends on: 675420 681407
Blocks:
  Show dependency treegraph
 
Reported: 2011-07-24 13:22 PDT by al_9x
Modified: 2011-10-08 10:35 PDT (History)
6 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
clear new uninitialized memory (1.81 KB, patch)
2011-07-26 04:12 PDT, Michal Novotny (:michal)
bzbarsky: review+
Details | Diff | Splinter Review

Description al_9x 2011-07-24 13:22:21 PDT
You should be able to find clusters of contiguous nsDiskCacheRecord structs whose mHashNumber is 0 and the other 12 bytes appear to be effectively a Fx memory dump of readable profile data (I've seen bookmarks jason, javascript)

Even though the data is full of 4 byte holes (mHashNumber), because the records are contiguous, the data is more or less readable. 

Fx should not be inadvertently storing potentially sensitive profile data in a totally unexpected location.
Comment 1 Michal Novotny (:michal) 2011-07-26 04:12:54 PDT
Created attachment 548407 [details] [diff] [review]
clear new uninitialized memory
Comment 2 Boris Zbarsky [:bz] (still a bit busy) 2011-07-26 06:18:17 PDT
Comment on attachment 548407 [details] [diff] [review]
clear new uninitialized memory

r=me
Comment 3 Michal Novotny (:michal) 2011-07-28 15:45:23 PDT
Tryserver is green except few intermittent failures.

http://hg.mozilla.org/mozilla-central/rev/dd7d71277a15
Comment 4 Boris Zbarsky [:bz] (still a bit busy) 2011-08-01 10:58:39 PDT
Please set the target milestone when checking things in....
Comment 5 neil@parkwaycc.co.uk 2011-08-02 02:00:03 PDT
Comment on attachment 548407 [details] [diff] [review]
clear new uninitialized memory

>-        // Clear the new empty entries
>-        for (PRUint32 i = count; i < newRecordsPerBucket; ++i)
>-            newRecords[i].SetHashNumber(0);
I think this block is still necessary when newArray + bucketIndex * newRecordsPerBucket + i < mHeader.mRecordCount since these are old entries that are no longer used and may otherwise be confused with live entries.

Note You need to log in before you can comment on or make changes to this bug.