827689 - Heap-buffer-overflow in LossyConvertEncoding8to16::write_sse2

Status: RESOLVED DUPLICATE of bug 827468

(Core :: XPCOM, defect)

Description

[Abhishek Arya]

Attachment: Testcase

>==21865== ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f566f97a4c0 at pc 0x7f56a406b56d bp 0x7ffff3520090 sp 0x7ffff3520088
>READ of size 16 at 0x7f566f97a4c0 thread T0
>    #0 0x7f56a406b56c in LossyConvertEncoding8to16::write_sse2(char const*, unsigned int) src/xpcom/string/src/nsUTF8UtilsSSE2.cpp:79
>    #1 0x7f569846ab38 in LossyConvertEncoding8to16::write(char const*, unsigned int) src/../../../dist/include/nsUTF8Utils.h:655
>    #2 0x7f569846a554 in nsCharSinkTraits<LossyConvertEncoding8to16>::write(LossyConvertEncoding8to16&, char const*, unsigned int) src/../../../dist/include/nsCharTraits.h:673
>    #3 0x7f56a3fe685a in LossyConvertEncoding8to16& copy_string<nsReadingIterator<char>, LossyConvertEncoding8to16>(nsReadingIterator<char> const&, nsReadingIterator<char> const&, LossyConvertEncoding8to16&) src/../../../dist/include/nsAlgorithm.h:89
>    #4 0x7f56a3fe3796 in AppendASCIItoUTF16(nsACString_internal const&, nsAString_internal&) src/xpcom/string/src/nsReadableUtils.cpp:129
>    #5 0x7f56a3fe3308 in CopyASCIItoUTF16(nsACString_internal const&, nsAString_internal&) src/xpcom/string/src/nsReadableUtils.cpp:22
>    #6 0x7f56981b1940 in nsGenericDOMDataNode::GetData(nsAString_internal&) const src/content/base/src/nsGenericDOMDataNode.cpp:152
>    #7 0x7f56a2183706 in mozilla::dom::CharacterDataBinding::get_data(JSContext*, JS::Handle<JSObject*>, nsGenericDOMDataNode*, JS::Value*) src/objdir-ff-asan-sym/dom/bindings/CharacterDataBinding.cpp:30
>    #8 0x7f56a2179806 in mozilla::dom::CharacterDataBinding::genericGetter(JSContext*, unsigned int, JS::Value*) src/objdir-ff-asan-sym/dom/bindings/CharacterDataBinding.cpp:356
>    #9 0x7f56ab9b3ec5 in js::CallJSNative(JSContext*, int (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) src/js/src/jscntxtinlines.h:373
>    #10 0x7f56ab9b3ec5 in js::InvokeKernel(JSContext*, JS::CallArgs, js::MaybeConstruct) src/js/src/jsinterp.cpp:391
>    #11 0x7f56ab264fdf in js::Invoke(JSContext*, js::InvokeArgsGuard&, js::MaybeConstruct) src/js/src/jsinterp.h:112
>    #12 0x7f56ab9b9c69 in js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value*, JS::Value*) src/js/src/jsinterp.cpp:439
>    #13 0x7f56ab9c00e5 in js::InvokeGetterOrSetter(JSContext*, JSObject*, JS::Value const&, unsigned int, JS::Value*, JS::Value*) src/js/src/jsinterp.cpp:512
>    #14 0x7f56abcc9838 in js::Shape::get(JSContext*, JS::Handle<JSObject*>, JSObject*, JSObject*, JS::MutableHandle<JS::Value>) src/js/src/jsscopeinlines.h:297
>    #15 0x7f56abc67bdf in js_NativeGetInline(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<js::Shape*>, unsigned int, JS::MutableHandle<JS::Value>) src/js/src/jsobj.cpp:3260
>    #16 0x7f56abc67bdf in js_GetPropertyHelperInline(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, long, unsigned int, JS::MutableHandle<JS::Value>) src/js/src/jsobj.cpp:3410
>    #17 0x7f56abc67bdf in js::GetPropertyHelper(JSContext*, JS::Handle<JSObject*>, JS::Handle<long>, unsigned int, JS::MutableHandle<JS::Value>) src/js/src/jsobj.cpp:3419
>    #18 0x7f56ab9ecbeb in js::GetPropertyOperation(JSContext*, JSScript*, unsigned char*, JS::MutableHandle<JS::Value>, JS::MutableHandle<JS::Value>) src/js/src/jsinterpinlines.h:290
>    #19 0x7f56ab95204f in js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) src/js/src/jsinterp.cpp:2235
>    #20 0x7f56ab8c4dcb in js::RunScript(JSContext*, JS::Handle<JSScript*>, js::StackFrame*) src/js/src/jsinterp.cpp:348
>    #21 0x7f56ab9b4809 in js::InvokeKernel(JSContext*, JS::CallArgs, js::MaybeConstruct) src/js/src/jsinterp.cpp:406
>    #22 0x7f56ab264fdf in js::Invoke(JSContext*, js::InvokeArgsGuard&, js::MaybeConstruct) src/js/src/jsinterp.h:112
>    #23 0x7f56ab9b9c69 in js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value*, JS::Value*) src/js/src/jsinterp.cpp:439
>    #24 0x7f56ab12c0f2 in JS_CallFunctionValue(JSContext*, JSObject*, JS::Value, unsigned int, JS::Value*, JS::Value*) src/js/src/jsapi.cpp:5805
>    #25 0x7f569df9bbc5 in nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) src/js/xpconnect/src/XPCWrappedJSClass.cpp:1432
>    #26 0x7f569df3ca10 in nsXPCWrappedJS::CallMethod(unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) src/js/xpconnect/src/XPCWrappedJS.cpp:581
>    #27 0x7f56a3fb547f in PrepareAndDispatch src/xpcom/reflect/xptcall/src/md/unix/xptcstubs_x86_64_linux.cpp:122
>    #28 0x7f56a3fb2166 in SharedStub
>    #29 0x7f5698d20245 in nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEventListener*, nsIDOMEvent*, nsIDOMEventTarget*, nsCxPusher*) src/content/events/src/nsEventListenerManager.cpp:922
>    #30 0x7f5698d21a57 in nsEventListenerManager::HandleEventInternal(nsPresContext*, nsEvent*, nsIDOMEvent**, nsIDOMEventTarget*, nsEventStatus*, nsCxPusher*) src/content/events/src/nsEventListenerManager.cpp:989
>    #31 0x7f5698f12c2a in nsEventListenerManager::HandleEvent(nsPresContext*, nsEvent*, nsIDOMEvent**, nsIDOMEventTarget*, nsEventStatus*, nsCxPusher*) src/content/events/src/nsEventListenerManager.h:278
>    #32 0x7f5698f01ddc in nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor&, bool, nsCxPusher*) src/content/events/src/nsEventDispatcher.cpp:181
>    #33 0x7f5698f00043 in nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor&, nsDispatchingCallback*, bool, nsCxPusher*) src/content/events/src/nsEventDispatcher.cpp:310
>    #34 0x7f5698f07d77 in nsEventDispatcher::Dispatch(nsISupports*, nsPresContext*, nsEvent*, nsIDOMEvent*, nsEventStatus*, nsDispatchingCallback*, nsCOMArray<nsIDOMEventTarget>*) src/content/events/src/nsEventDispatcher.cpp:678
>    #35 0x7f5698f0a5c9 in nsEventDispatcher::DispatchDOMEvent(nsISupports*, nsEvent*, nsIDOMEvent*, nsPresContext*, nsEventStatus*) src/content/events/src/nsEventDispatcher.cpp:738
>    #36 0x7f5698207af5 in nsINode::DispatchEvent(nsIDOMEvent*, bool*) src/content/base/src/nsINode.cpp:1100
>    #37 0x7f5697ced900 in nsContentUtils::DispatchEvent(nsIDocument*, nsISupports*, nsAString_internal const&, bool, bool, bool, bool*) src/content/base/src/nsContentUtils.cpp:3511
>    #38 0x7f5697cecbd4 in nsContentUtils::DispatchTrustedEvent(nsIDocument*, nsISupports*, nsAString_internal const&, bool, bool, bool*) src/content/base/src/nsContentUtils.cpp:3481
>    #39 0x7f5697f1993f in nsDocument::DispatchContentLoadedEvents() src/content/base/src/nsDocument.cpp:4223
>    #40 0x7f5698014c02 in nsRunnableMethodImpl<void (nsDocument::*)(), true>::Run() src/../../../dist/include/nsThreadUtils.h:367
>    #41 0x7f56a3e85f6f in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:627
>    #42 0x7f56a3afa7b5 in NS_ProcessNextEvent_P(nsIThread*, bool) src/objdir-ff-asan-sym/xpcom/build/nsThreadUtils.cpp:237
>    #43 0x7f56a102ef2c in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:82
>    #44 0x7f56a41778e2 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:215
>    #45 0x7f56a4177719 in MessageLoop::RunHandler() src/ipc/chromium/src/base/message_loop.cc:208
>    #46 0x7f56a41775ee in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:182
>    #47 0x7f56a0419c07 in nsBaseAppShell::Run() src/widget/xpwidgets/nsBaseAppShell.cpp:163
>    #48 0x7f569ef30715 in nsAppStartup::Run() src/toolkit/components/startup/nsAppStartup.cpp:288
>    #49 0x7f5694178874 in XREMain::XRE_mainRun() src/toolkit/xre/nsAppRunner.cpp:3823
>    #50 0x7f569417e45a in XREMain::XRE_main(int, char**, nsXREAppData const*) src/toolkit/xre/nsAppRunner.cpp:3890
>    #51 0x7f5694181230 in XRE_main src/toolkit/xre/nsAppRunner.cpp:4093
>    #52 0x41db83 in do_main(int, char**, nsIFile*) src/browser/app/nsBrowserApp.cpp:195
>    #53 0x41ae86 in main src/browser/app/nsBrowserApp.cpp:388
>    #54 0x7f56b5d8676c in
>0x7f566f97a4c0 is located 0 bytes to the right of 64-byte region [0x7f566f97a480,0x7f566f97a4c0)
>allocated by thread T0 here:
>    #0 0x40fd57 in __interceptor_realloc
>    #1 0x7f56b6da4532 in moz_realloc src/memory/mozalloc/mozalloc.cpp:96
>    #2 0x7f5697b99ae7 in nsAttrAndChildArray::GrowBy(unsigned int) src/content/base/src/nsAttrAndChildArray.cpp:759
>    #3 0x7f5697b973a3 in nsAttrAndChildArray::InsertChildAt(nsIContent*, unsigned int) src/content/base/src/nsAttrAndChildArray.cpp:170
>    #4 0x7f569820befa in nsINode::doInsertChildAt(nsIContent*, unsigned int, bool, nsAttrAndChildArray&) src/content/base/src/nsINode.cpp:1314
>    #5 0x7f56985fd177 in mozilla::dom::FragmentOrElement::InsertChildAt(nsIContent*, unsigned int, bool) src/content/base/src/FragmentOrElement.cpp:884
>    #6 0x7f5698214fa5 in nsINode::ReplaceOrInsertBefore(bool, nsINode*, nsINode*, mozilla::ErrorResult&) src/content/base/src/nsINode.cpp:1928
>    #7 0x7f569815ce1d in nsINode::InsertBefore(nsINode&, nsINode*, mozilla::ErrorResult&) src/../../dist/include/nsINode.h:1516
>    #8 0x7f56981592b2 in nsINode::AppendChild(nsINode&, mozilla::ErrorResult&) src/../../dist/include/nsINode.h:1520
>    #9 0x7f56a2d94183 in mozilla::dom::NodeBinding::appendChild(JSContext*, JS::Handle<JSObject*>, nsINode*, unsigned int, JS::Value*) src/objdir-ff-asan-sym/dom/bindings/NodeBinding.cpp:568
>    #10 0x7f56a2d40376 in mozilla::dom::NodeBinding::genericMethod(JSContext*, unsigned int, JS::Value*) src/objdir-ff-asan-sym/dom/bindings/NodeBinding.cpp:1390
>    #11 0x7f56ab9b3ec5 in js::CallJSNative(JSContext*, int (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) src/js/src/jscntxtinlines.h:373
>    #12 0x7f56ab9b3ec5 in js::InvokeKernel(JSContext*, JS::CallArgs, js::MaybeConstruct) src/js/src/jsinterp.cpp:391
>    #13 0x7f56ab964986 in js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) src/js/src/jsinterp.cpp:2368
>    #14 0x7f56ab8c4dcb in js::RunScript(JSContext*, JS::Handle<JSScript*>, js::StackFrame*) src/js/src/jsinterp.cpp:348
>    #15 0x7f56ab9c16e5 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::ExecuteType, js::StackFrame*, JS::Value*) src/js/src/jsinterp.cpp:537
>    #16 0x7f56ab9c3285 in js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) src/js/src/jsinterp.cpp:576
>    #17 0x7f56ab11f12e in JS::Evaluate(JSContext*, JS::Handle<JSObject*>, JS::CompileOptions, unsigned short const*, unsigned long, JS::Value*) src/js/src/jsapi.cpp:5624
>    #18 0x7f569a826420 in nsJSContext::EvaluateString(nsAString_internal const&, JSObject*, nsIPrincipal*, nsIPrincipal*, char const*, unsigned int, JSVersion, nsAString_internal*, bool*) src/dom/base/nsJSEnvironment.cpp:1525
>    #19 0x7f5698425ba3 in nsScriptLoader::EvaluateScript(nsScriptLoadRequest*, nsString const&) src/content/base/src/nsScriptLoader.cpp:859
>    #20 0x7f56984230ce in nsScriptLoader::ProcessRequest(nsScriptLoadRequest*) src/content/base/src/nsScriptLoader.cpp:757
>    #21 0x7f569841dfa4 in nsScriptLoader::ProcessScriptElement(nsIScriptElement*) src/content/base/src/nsScriptLoader.cpp:705
>    #22 0x7f569840ecf6 in nsScriptElement::MaybeProcessScript() src/content/base/src/nsScriptElement.cpp:139
>    #23 0x7f569a078088 in nsIScriptElement::AttemptToExecute() src/../../dist/include/nsIScriptElement.h:220
>    #24 0x7f569bddfdd8 in nsHtml5TreeOpExecutor::RunScript(nsIContent*) src/parser/html/nsHtml5TreeOpExecutor.cpp:791
>    #25 0x7f569bddcc7f in nsHtml5TreeOpExecutor::RunFlushLoop() src/parser/html/nsHtml5TreeOpExecutor.cpp:595
>Shadow bytes around the buggy address:
>  0x1feacdf2f440: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>  0x1feacdf2f450: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>  0x1feacdf2f460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>  0x1feacdf2f470: 00 00 00 00 00 00 00 00 fb fb fb fb fb fb fb fb
>  0x1feacdf2f480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>=>0x1feacdf2f490: 00 00 00 00 00 00 00 00[fb]fb fb fb fb fb fb fb
>  0x1feacdf2f4a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>  0x1feacdf2f4b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>  0x1feacdf2f4c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>  0x1feacdf2f4d0: 00 00 00 00 00 00 00 00 fb fb fb fb fb fb fb fb
>  0x1feacdf2f4e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>Shadow byte legend (one shadow byte represents 8 application bytes):
>  Addressable:           00
>  Partially addressable: 01 02 03 04 05 06 07
>  Heap left redzone:     fa
>  Heap righ redzone:     fb
>  Freed Heap region:     fd
>  Stack left redzone:    f1
>  Stack mid redzone:     f2
>  Stack right redzone:   f3
>  Stack partial redzone: f4
>  Stack after return:    f5
>  Stack use after scope: f8
>  Global redzone:        f9
>  Global init order:     f6
>  Poisoned by user:      f7
>  ASan internal:         fe
>Stats: 262M malloced (284M for red zones) by 425940 calls
>Stats: 47M realloced by 25030 calls
>Stats: 231M freed by 298095 calls
>Stats: 97M really freed by 206873 calls
>Stats: 480M (480M-0M) mmaped; 120 maps, 0 unmaps
>  mmaps   by size class: 8:294894; 9:32764; 10:8190; 11:16376; 12:3072; 13:1536; 14:1280; 15:384; 16:1280; 17:1280; 18:48; 19:40; 20:24;
>  mallocs by size class: 8:351527; 9:33893; 10:10729; 11:19701; 12:2936; 13:1984; 14:1645; 15:421; 16:1612; 17:1361; 18:69; 19:40; 20:22;
>  frees   by size class: 8:241165; 9:24184; 10:7116; 11:17509; 12:1935; 13:1564; 14:1462; 15:298; 16:1403; 17:1344; 18:58; 19:38; 20:19;
>  rfrees  by size class: 8:177857; 9:9507; 10:3647; 11:12144; 12:964; 13:616; 14:577; 15:164; 16:1038; 17:328; 18:26; 19:4; 20:1;
>Stats: malloc large: 1492 small slow: 2582
>Stats: StackDepot: 0 ids; 0M mapped
>==21865== ABORTING
>
>
>

Comment 1

[Mats Palmgren (inactive)]

Related to bug 827426?

Comment 2

[Justin Lebar (not reading bugmail)]

In my asan build (which may have some sorts of Gecko assertions enabled), I get

> Assertion failure: !objRef.ptr, at /Users/jlebar/code/moz/ff-git/asan/dom/bindings/CharacterDataBinding.cpp:347

I get this in a vanilla debug build as well.

I don't get to the invalid read in comment 0; perhaps the assertion happens before then.

Comment 3

[Justin Lebar (not reading bugmail)]

Given the assertion above, perhaps this is an issue in the DOM bindings, rather than in the SSE conversion code?

Comment 4

[Justin Lebar (not reading bugmail)]

I'll test this by disabling the SSE bits (just do a bit-by-bit copy) and seeing if we still get the asan error.  But I need to rebuild my asan build with --disable-optimizations, so it'll take a bit.

Comment 5

[Boris Zbarsky [:bzbarsky]]

> Given the assertion above, perhaps this is an issue in the DOM bindings

Yes.

Comment 6

[Boris Zbarsky [:bzbarsky]]

And sorry for the trouble.  :(

Comment 7

[Boris Zbarsky [:bzbarsky]]

Oh, and this should be fixed in today's builds, but worth double-checking.  My debug build is certainly not hitting any assertions here.

Comment 8

[Abhishek Arya]

(In reply to Boris Zbarsky (:bz) from comment #7)
> Oh, and this should be fixed in today's builds, but worth double-checking. 
> My debug build is certainly not hitting any assertions here.

Verified that it does not reproduce on trunk.