971189 - Faulty/ASan: heap use-after-free of a gfxImageSurface by imgRequest::UpdateCacheEntrySize

Status: RESOLVED INVALID

(Core :: Graphics: ImageLib, defect)

Description

[Benoit Jacob [:bjacob] (mostly away)]

Attachment: Faulty/ASan session

Found by Christoph Diehl's "Faulty" fuzzer, see bug 777067

This looks like a ImageLib bug, but I hit it by fuzzing only gfx/layers IPC protocols, so I suspect it has something to do with graphics.

This is a client-side crash, but for some reason, it is causing a hang of the parent process (I am running a desktop linux build with tabs.remote) which is why I care. I don't want us to focus on that aspect for now though, because I have a massive pile of local patches which might be causing this collateral damage.

Let's focus on the ImageLib use-after-free for now.

Comment 1

[Benoit Jacob [:bjacob] (mostly away)]

This reproduces easily with

FAULTY_SEED=154317361 FAULTY_PICKLE=1 FAULTY_PARENT=1 FAULTY_ENABLE_LOGGING=1 FAULTY_PROBABILITY=1000 ./mach reftest --debugger=gdb image/test/reftest/encoders-lossless

Comment 2

[Benoit Jacob [:bjacob] (mostly away)]

A google search turned this up... ASan bug already reported by our own, most excellent, people, and already fixed upstream --- I'm still using clang 3.3.

Comment 3

[Benoit Jacob [:bjacob] (mostly away)]

https://code.google.com/p/address-sanitizer/issues/detail?id=193

Comment 4

[Benoit Jacob [:bjacob] (mostly away)]

The workaround given there works:

ASAN_OPTIONS=check_malloc_usable_size=0