861473 - WebVTT Heap Buffer Overflow [mozilla::dom::Element::UnbindFromTree]

Status: VERIFIED FIXED

(Core :: Audio/Video, defect)

Description

[Raymond Forbes[:rforbes]]

Attachment: testcase

using peach i have found a potential heap buffer overflow.  I have included the test case and the callstack.

Comment 1

[Raymond Forbes[:rforbes]]

Attachment: callstack

Comment 2

[Randell Jesup [:jesup] (needinfo me)]

-> rillian for triage/investigation

Comment 3

[Ralph Giles (:rillian)]

I cannot reproduce with the current integration branch b17734d3759a20b2c2d290ae1344cb611f214017.

Raymond, what revision is this reported against?

Comment 4

[Ralph Giles (:rillian)]

Via IRC, rforbes reports testing revision 018ee907ad8eb48e44562c70d588cd6001143220.

Comment 5

[Ralph Giles (:rillian)]

I've run an asan build the above revision, plus some patches to resolve compilation problems with clang r176868. I get a use-after-free instead of the overflow, and a clean run with current integration HEAD. Either way it looks like this issue is resolved.

:rforbes, can you confirm, please?

Comment 6

[Raymond Forbes[:rforbes]]

looks good to me.  i will close the bug.

Comment 7

[Ralph Giles (:rillian)]

Thanks, Raymond!