987531 - crash in xtls.dll@0x1d1f5

Status: RESOLVED WORKSFORME

(Core :: Widget, defect)

Description

[juan becerra [:juanb]]

This bug was filed from the Socorro interface and is 
report bp-74056e27-486c-444b-bd86-dd2162140324.
=============================================================

This is showing up in Firefox 28 (release) in the top #20, and it is at the top of the list in the explosive reports for Fx28. It looks to be a startup crash. There are also reports in Fx27.0.1

This is also affecting Firefox 29 (beta).

A quick search for this dll points to Yontoo, which is an add-on that doesn't seem to be available anymore.

Comment 1

[Robert Kaiser]

(In reply to juan becerra [:juanb] from comment #0)
> A quick search for this dll points to Yontoo, which is an add-on that
> doesn't seem to be available anymore.

Hmm, do we have an add-on correlation that confirms that? Or is this not add-on but hooking in the DLL after all?

In any case, do we need to go for blocklisting here?

Comment 2

[juan becerra [:juanb]]

I don't see an add-on correlation that confirms that, so it could be something else. It's just that all the search results in Google mentioned Yontoo. I'm trying to reach out to various users experiencing this to find out more. I'll report back after I get some more information.

Comment 3

[(Away)]

It's another shifty module.

    Image path: C:\Program Files\PacFunction\bin\XTLS.dll
    Image path: C:\Program Files\RightSurf\bin\XTLS.dll
    Image path: C:\Program Files\Mega Browse\bin\XTLS.dll
    Image path: C:\Program Files\FindRight\bin\XTLS.dll
    Image path: C:\Program Files\LinkiDoo\bin\XTLS.dll

All had the same timestamp (but different checksums) confirming that this is a recent outbreak:

    Timestamp:        Sun Mar 23 22:51:32 2014 (532EAEA4)

Comment 4

[Robert Kaiser]

David, can we do something with blocklisting there?

Comment 5

[(Away)]

This signature dropped off very sharply last week. So much that I don't think it can be explained by antivirus changes or lost users. I suspect that there has been an update to this software. Is it still worth blocking?

Comment 6

[Sylvestre Ledru [:Sylvestre]]

Updating the tracking wrt comment #5

Comment 7

[Wayne Mery (:wsmwk)]

No signatures contain xtls.dll in the past 2 months - https://crash-stats.mozilla.com/search/?signature=~xtls.dll&product=Firefox&date=%3E2015-08-01&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform

And almost all nsAppShell::ProcessNextNativeEvent(bool) are android bug 1060267.
A few rare examples, all 40.0.3
bp-799810f7-7fad-48bf-b2cf-1777b2150902
bp-113327ca-5b16-4cca-8db3-a163a2150928
bp-48fb3051-c201-4581-b24e-c36062150918

from comment 0
 xtls.dll@0x1d1f5 More Reports Search
bp-74056e27-486c-444b-bd86-dd2162140324
 Ø 0 	XTLS.dll	XTLS.dll@0x1d1f5	
Ø 1 	XTLS.dll	XTLS.dll@0xcd36	
2 	user32.dll	DispatchHookW	
3 	user32.dll	fnHkINLPCWPSTRUCTW	
4 	user32.dll	__fnDWORD	
5 	ntdll.dll	KiUserCallbackDispatcher	
6 	ntdll.dll	KiUserApcDispatcher	
7 	user32.dll	PeekMessageW