718311 - instanceof for worker properties segfaults, crash [@ WorkerGlobalScope::GetOnErrorListener ]

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jussi Kalliokoski]

Attachment: gdb stacktrace (not very helpful)

I flagged this as a security issue, because you can make Firefox segfault via JS with this.

So beware, going to the page might just make the whole browser crash.

Go to http://bugs.avd.io/firefox/worker-segfault.html

I'm running Arch Linux, Aurora 11.02a, although this is reproducible on every instance of Firefox, on my laptop at least.

What it does is invoke a worker, source available here: http://bugs.avd.io/firefox/worker-segfault.js

Comment 1

[David Humphrey (:humph)]

Confirmed on nightly on Mac:

https://crash-stats.mozilla.com/report/index/bp-a25632ac-a02d-4563-aef6-1a23e2120115

Comment 2

[Daniel Veditz [:dveditz]]

I got a similar crash bp-402e7b35-e7cc-4f47-95cc-611062120116
Both crashes are on null or null+offset so it might not be exploitable, but can't entirely tell without more investigation (e.g. running in Valgrind/ASan, or finding the bug itself).

I happened to be testing 9.0.1 so this goes back a ways.

Comment 3

[Daniel Veditz [:dveditz]]

Attachment: preserving Jussi's testcase

Comment 4

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Attachment: Patch, v1

Hm, dumb bug. I doubt this is exploitable because it's just sending a null pointer into the JS engine, but the fix is simple.

Comment 5

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Attachment: Patch, v1

That was the wrong patch, sorry.

Comment 6

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Attachment: Patch, v1

Ugh, third time is the charm.

Comment 7

[Ben Turner (not reading bugmail, use the needinfo flag!)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/04890cad686c

Comment 8

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/04890cad686c

Comment 9

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Comment on attachment 589036 [details] [diff] [review]
Patch, v1

[Approval Request Comment]
Regression caused by (bug #): Bug 649537
User impact if declined: Crash
Testing completed (on m-c, etc.): m-c
Risk to taking this patch (and alternatives if risky): None. This simply returns null instead of crashing.

Comment 10

[Alex Keybl [:akeybl]]

Comment on attachment 589036 [details] [diff] [review]
Patch, v1

[Triage Comment]
Given the low risk evaluation of this fix, and the security team's recommendation, let's take this on aurora/beta.

Comment 11

[Ben Turner (not reading bugmail, use the needinfo flag!)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/922795c904e8
https://hg.mozilla.org/releases/mozilla-beta/rev/a02b2c63e8d9

Comment 12

[Al Billings [:abillings - ex-MoCo]]

Verified fixed in 12 with Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:12.0a1) Gecko/20120123 Firefox/12.0a1 after crashing in 9.0.1 on same machine with testcase.

Verified fixed in 11 with Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:11.0a2) Gecko/20120120 Firefox/11.0a2.