767867 - Crash comctl32.dll@0x185f68 F1398665248_____________________________ F242739041__________________________________ F_935120839__________________________________ NPSWF32_11_3_300_262.dll@0x319a8f

Status: RESOLVED FIXED

(External Software Affecting Firefox :: Flash (Adobe), defect)

Description

[Bob Clary [:bc] (inactive)]

Attachment: aurora log

1. http://www.stream.cz/video/691242-autosalon-2012-25?utm_source=Seznam&utm_medium=RSS&utm_campaign=Vyber&tab_no=0&position=0

2. Shutdown

3. Crash automation on Aurora on Win7 hit once:

comctl32.dll@0x185f68
F1398665248_____________________________ F242739041__________________________________ F_935120839__________________________________ NPSWF32_11_3_300_262.dll@0x319a8f

Will attach crash report and output log. Note breakpad's exploitable tool rated this as highly exploitable.

Running under windbg was not reliable but could be reproduced on Aurora and Nighty at least but the stacks were unrelated to that reported in automation. The crash involved 0xfeeefeee which is freed heap memory. See attached windbg log. Note !exploitable rated this as probably exploitable

Comment 1

[Bob Clary [:bc] (inactive)]

Attachment: aurora crash report

Comment 2

[Bob Clary [:bc] (inactive)]

Attachment: windbg output

contains several different crashes for aurora and nightly.

Comment 3

[Bob Clary [:bc] (inactive)]

PS. Note you may have to load the site and shutdown multiple times to see the crash.

Comment 4

[Benjamin Smedberg]

bc, I don't think these necessarily need to be private. In particular, the crash here is in the plugin-container process, and because Flash content doesn't run in this process (in sandbox mode) it would be very difficult to heap smash or do anything else to exploit this crash even when we're jumping off in the weeds. It would probably be useful to collect minidumps or full dumps from the FlashPlayer_*.exe process(es) though, if your automation can do that.

Comment 7

[Bob Clary [:bc] (inactive)]

Jeromie, if you create an issue for this can you add bclary? thanks.

Comment 8

[Bob Clary [:bc] (inactive)]

I have at least one additional crash where I've found eax == 0xfeeefeee but it isn't clear to me if it is the same as this bug.

I noticed the dump tar balls were downloaded by Adobe yesterday evening. Were they helpful at all? Is it worth creating new ones? Is there something else I can do to help?

Comment 9

[Bob Clary [:bc] (inactive)]

This F1398665248 is not reproducible since 2012-07-11 which is when I started testing '265.

-> fixed.

Comment 10

[BMO Automation]

Version and milestone values are being reset to defaults as part of product refactoring.