Ben Hawkes reports that his testcase from Bug 686398, https://bugzilla.mozilla.org/attachment.cgi?id=559916 still crashes Firefox 10.0a1 on Windows. Here is a crash report: https://crash-stats.mozilla.com/report/index/bp-75d8250b-6c46-4f0d-8115-6a6472111017 This is very different from Bug 686398, is a ANGLE bug (need to report upstream) and potentially a security concern (invalid read at non-null address).
Benoit, does the invalid read affect control flow? I.e. do you think this is sg:critical or lower?
I don't know, this requires understanding ANGLE code better than I do. Sorry I forgot to forward this bug to ANGLE until now.
Pushed my tentative fix to try: https://tbpl.mozilla.org/?tree=Try&rev=eb63e500a6bb this has less than 50% chances of working, please still give it a try.
Did the try build (comment 4) fix the crash? Based on the crash link this is crashing trying to read when doing image->surface->Release(); which means it could theoretically lead to calling an attacker-supplied function on a fake object.
Suggest trying with ANGLE SVN head. We've completely rewritten much of the texture code.
(In reply to daniel-bzmz from comment #7) > Suggest trying with ANGLE SVN head. We've completely rewritten much of the > texture code. Will do the ANGLE update as soon as possible. Meanwhile, can you have a look at my patch here and check if this is something that you'd want to take in ANGLE anyway? It just adds some error checking.
We rewrote much of the texture handling code, so it may no longer be relevant. We'll see if we can reproduce the problem before/after.
We found the underlying bug causing the problem here. Will be fixed soon.
Fixed in ANGLE r885. Should be easily cherry-pick-able if desired.
If this is a major security concern for FF9/10, please nominate for approval on beta/aurora.
(In reply to daniel-bzmz from comment #11) > Fixed in ANGLE r885. Should be easily cherry-pick-able if desired. Benoit: please prepare such a check-pick patch for landing in Firefox 10 (and if safe, Fx9).
Created attachment 582114 [details] [diff] [review] import angle r885 in aurora Here you go. No review because this is a ANGLE rev and already using it on m-c. https://tbpl.mozilla.org/?tree=Try&rev=0e57ebad2fb5
Comment on attachment 582114 [details] [diff] [review] import angle r885 in aurora [Triage Comment] Approved for Aurora. Please land on Monday 12/19 or earlier in order to make the cut-over to Beta.
Mozilla/5.0 (Windows NT 6.1; rv:11.0) Gecko/20100101 Firefox/11.0 Mozilla/5.0 (Windows NT 6.1; rv:10.0.1) Gecko/20100101 Firefox/10.0.1 Verified with 11b3 and 10.0.1 on Windows 7 x86. No crash when running the testcase from comment 0. Could previously replicate the crash on the affected branches (F8).