998711 - Heap-buffer-overflow in speex_resampler_process_float

Reporter

Description

•

11 years ago

Attached file Testcase, run the html file in archive — Details

==12513==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6050004be820 at pc 0x7f04190da560 bp 0x7f03edb41cd0 sp 0x7f03edb41cc8 READ of size 4 at 0x6050004be820 thread T31 (Media Decode #2) #0 0x7f04190da55f in speex_resampler_process_float media/libspeex_resampler/src/resample.c:888 #1 0x7f0416db5115 in void mozilla::AudioSegment::Resample<float>(SpeexResamplerState_*, unsigned int, unsigned int) content/media/AudioSegment.h:200 #2 0x7f0416db4a5a in mozilla::AudioSegment::ResampleChunks(SpeexResamplerState_*) content/media/AudioSegment.cpp:140 #3 0x7f0416df86fb in mozilla::SourceMediaStream::AppendToTrack(int, mozilla::MediaSegment*, mozilla::MediaSegment*) content/media/MediaStreamGraph.cpp:2319 #4 0x7f0416df5955 in mozilla::MediaDecoderStateMachine::SendStreamData() content/media/MediaDecoderStateMachine.cpp:404 #5 0x7f0416dfd2f9 in mozilla::MediaDecoderStateMachine::DecodeAudio() content/media/MediaDecoderStateMachine.cpp:684 #6 0x7f0416e56990 in nsRunnableMethodImpl<void (mozilla::MediaDecoderStateMachine::*)(), void, true>::Run() objdir-ff-asan/content/media/../../dist/include/nsThreadUtils.h:387 #7 0x7f0416e40db0 in mozilla::MediaTaskQueue::Runner::Run() content/media/MediaTaskQueue.cpp:127 #8 0x7f04131455da in nsThreadPool::Run() xpcom/threads/nsThreadPool.cpp:211 #9 0x7f04131458dc in non-virtual thunk to nsThreadPool::Run() objdir-ff-asan/xpcom/threads/Unified_cpp_xpcom_threads0.cpp:225 #10 0x7f0413140020 in nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:699 #11 0x7f0413004fda in NS_ProcessNextEvent(nsIThread*, bool) xpcom/glue/nsThreadUtils.cpp:263 #12 0x7f0413915696 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:307 #13 0x7f04138bd3b0 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:226 #14 0x7f041313ce05 in nsThread::ThreadFunc(void*) xpcom/threads/nsThread.cpp:311 #15 0x7f041f3a0d95 in _pt_root nsprpub/pr/src/pthreads/ptthread.c:212 #16 0x7f04228c8f6d in start_thread /build/buildd/eglibc-2.17/nptl/pthread_create.c:311 0x6050004be821 is located 0 bytes to the right of 1-byte region [0x6050004be820,0x6050004be821) allocated by thread T31 (Media Decode #2) here: #0 0x473e91 in calloc _asan_rtl_ #1 0x7f04190d73fa in speex_resampler_init_frac media/libspeex_resampler/src/resample.c:68 #2 0x7f04190d707a in speex_resampler_init media/libspeex_resampler/src/resample.c:756 #3 0x7f0416e39499 in mozilla::SourceMediaStream::ResampleAudioToGraphSampleRate(mozilla::SourceMediaStream::TrackData*, mozilla::MediaSegment*) content/media/MediaStreamGraph.cpp:2288 #4 0x7f0416df86fb in mozilla::SourceMediaStream::AppendToTrack(int, mozilla::MediaSegment*, mozilla::MediaSegment*) content/media/MediaStreamGraph.cpp:2319 #5 0x7f0416df5955 in mozilla::MediaDecoderStateMachine::SendStreamData() content/media/MediaDecoderStateMachine.cpp:404 #6 0x7f0416dfd2f9 in mozilla::MediaDecoderStateMachine::DecodeAudio() content/media/MediaDecoderStateMachine.cpp:684 #7 0x7f0416e56990 in nsRunnableMethodImpl<void (mozilla::MediaDecoderStateMachine::*)(), void, true>::Run() objdir-ff-asan/content/media/../../dist/include/nsThreadUtils.h:387 #8 0x7f0416e40db0 in mozilla::MediaTaskQueue::Runner::Run() content/media/MediaTaskQueue.cpp:127 #9 0x7f04131455da in nsThreadPool::Run() xpcom/threads/nsThreadPool.cpp:211 #10 0x7f04131458dc in non-virtual thunk to nsThreadPool::Run() objdir-ff-asan/xpcom/threads/Unified_cpp_xpcom_threads0.cpp:225 #11 0x7f0413140020 in nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:699 #12 0x7f0413004fda in NS_ProcessNextEvent(nsIThread*, bool) xpcom/glue/nsThreadUtils.cpp:263 #13 0x7f0413915696 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:307 #14 0x7f04138bd3b0 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:226 #15 0x7f041313ce05 in nsThread::ThreadFunc(void*) xpcom/threads/nsThread.cpp:311 #16 0x7f041f3a0d95 in _pt_root nsprpub/pr/src/pthreads/ptthread.c:212 #17 0x7f04228c8f6d in start_thread /build/buildd/eglibc-2.17/nptl/pthread_create.c:311 Thread T31 (Media Decode #2) created by T30 (Media Decode #1) here: #0 0x4602f5 in __interceptor_pthread_create _asan_rtl_ #1 0x7f041f39d71d in _PR_CreateThread nsprpub/pr/src/pthreads/ptthread.c:453 #2 0x7f041f39d29a in PR_CreateThread nsprpub/pr/src/pthreads/ptthread.c:544 #3 0x7f041313e19b in nsThread::Init() xpcom/threads/nsThread.cpp:384 #4 0x7f041314361c in nsThreadManager::NewThread(unsigned int, unsigned int, nsIThread**) xpcom/threads/nsThreadManager.cpp:232 #5 0x7f04131449ca in nsThreadPool::PutEvent(nsIRunnable*) xpcom/threads/nsThreadPool.cpp:95 #6 0x7f0413145cf6 in nsThreadPool::Dispatch(nsIRunnable*, unsigned int) xpcom/threads/nsThreadPool.cpp:249 #7 0x7f0416e4107a in mozilla::MediaTaskQueue::Runner::Run() content/media/MediaTaskQueue.cpp:158 #8 0x7f04131455da in nsThreadPool::Run() xpcom/threads/nsThreadPool.cpp:211 #9 0x7f04131458dc in non-virtual thunk to nsThreadPool::Run() objdir-ff-asan/xpcom/threads/Unified_cpp_xpcom_threads0.cpp:225 #10 0x7f0413140020 in nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:699 #11 0x7f0413004fda in NS_ProcessNextEvent(nsIThread*, bool) xpcom/glue/nsThreadUtils.cpp:263 #12 0x7f0413915696 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:307 #13 0x7f04138bd3b0 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:226 #14 0x7f041313ce05 in nsThread::ThreadFunc(void*) xpcom/threads/nsThread.cpp:311 #15 0x7f041f3a0d95 in _pt_root nsprpub/pr/src/pthreads/ptthread.c:212 #16 0x7f04228c8f6d in start_thread /build/buildd/eglibc-2.17/nptl/pthread_create.c:311 Thread T30 (Media Decode #1) created by T29 (Media S~hine #1) here: #0 0x4602f5 in __interceptor_pthread_create _asan_rtl_ #1 0x7f041f39d71d in _PR_CreateThread nsprpub/pr/src/pthreads/ptthread.c:453 #2 0x7f041f39d29a in PR_CreateThread nsprpub/pr/src/pthreads/ptthread.c:544 #3 0x7f041313e19b in nsThread::Init() xpcom/threads/nsThread.cpp:384 #4 0x7f041314361c in nsThreadManager::NewThread(unsigned int, unsigned int, nsIThread**) xpcom/threads/nsThreadManager.cpp:232 #5 0x7f04131449ca in nsThreadPool::PutEvent(nsIRunnable*) xpcom/threads/nsThreadPool.cpp:95 #6 0x7f0413145cf6 in nsThreadPool::Dispatch(nsIRunnable*, unsigned int) xpcom/threads/nsThreadPool.cpp:249 #7 0x7f0416e06127 in mozilla::MediaTaskQueue::Dispatch(nsIRunnable*) content/media/MediaTaskQueue.cpp:41 #8 0x7f0416e0cbb3 in mozilla::MediaDecoderStateMachine::RunStateMachine() content/media/MediaDecoderStateMachine.cpp:1487 #9 0x7f0416e10f53 in mozilla::TimeoutExpired(nsITimer*, void*) content/media/MediaDecoderStateMachine.cpp:2687 #10 0x7f0413148914 in nsTimerImpl::Fire() xpcom/threads/nsTimerImpl.cpp:551 #11 0x7f0413148f9e in nsTimerEvent::Run() xpcom/threads/nsTimerImpl.cpp:635 #12 0x7f04131455da in nsThreadPool::Run() xpcom/threads/nsThreadPool.cpp:211 #13 0x7f04131458dc in non-virtual thunk to nsThreadPool::Run() objdir-ff-asan/xpcom/threads/Unified_cpp_xpcom_threads0.cpp:225 #14 0x7f0413140020 in nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:699 #15 0x7f0413004fda in NS_ProcessNextEvent(nsIThread*, bool) xpcom/glue/nsThreadUtils.cpp:263 #16 0x7f0413915696 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:307 #17 0x7f04138bd3b0 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:226 #18 0x7f041313ce05 in nsThread::ThreadFunc(void*) xpcom/threads/nsThread.cpp:311 #19 0x7f041f3a0d95 in _pt_root nsprpub/pr/src/pthreads/ptthread.c:212 #20 0x7f04228c8f6d in start_thread /build/buildd/eglibc-2.17/nptl/pthread_create.c:311 Thread T29 (Media S~hine #1) created by T9 (Timer) here: #0 0x4602f5 in __interceptor_pthread_create _asan_rtl_ #1 0x7f041f39d71d in _PR_CreateThread nsprpub/pr/src/pthreads/ptthread.c:453 #2 0x7f041f39d29a in PR_CreateThread nsprpub/pr/src/pthreads/ptthread.c:544 #3 0x7f041313e19b in nsThread::Init() xpcom/threads/nsThread.cpp:384 #4 0x7f041314361c in nsThreadManager::NewThread(unsigned int, unsigned int, nsIThread**) xpcom/threads/nsThreadManager.cpp:232 #5 0x7f04131449ca in nsThreadPool::PutEvent(nsIRunnable*) xpcom/threads/nsThreadPool.cpp:95 #6 0x7f0413145cf6 in nsThreadPool::Dispatch(nsIRunnable*, unsigned int) xpcom/threads/nsThreadPool.cpp:249 #7 0x7f041313734a in nsTimerImpl::PostTimerEvent() xpcom/threads/nsTimerImpl.cpp:677 #8 0x7f041313693b in TimerThread::Run() xpcom/threads/TimerThread.cpp:256 #9 0x7f0413140020 in nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:699 #10 0x7f0413004fda in NS_ProcessNextEvent(nsIThread*, bool) xpcom/glue/nsThreadUtils.cpp:263 #11 0x7f0413915696 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:307 #12 0x7f04138bd3b0 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:226 #13 0x7f041313ce05 in nsThread::ThreadFunc(void*) xpcom/threads/nsThread.cpp:311 #14 0x7f041f3a0d95 in _pt_root nsprpub/pr/src/pthreads/ptthread.c:212 #15 0x7f04228c8f6d in start_thread /build/buildd/eglibc-2.17/nptl/pthread_create.c:311 Thread T9 (Timer) created by T8 (Cache2 I/O) here: #0 0x4602f5 in __interceptor_pthread_create _asan_rtl_ #1 0x7f041f39d71d in _PR_CreateThread nsprpub/pr/src/pthreads/ptthread.c:453 #2 0x7f041f39d29a in PR_CreateThread nsprpub/pr/src/pthreads/ptthread.c:544 #3 0x7f041313e19b in nsThread::Init() xpcom/threads/nsThread.cpp:384 #4 0x7f041314361c in nsThreadManager::NewThread(unsigned int, unsigned int, nsIThread**) xpcom/threads/nsThreadManager.cpp:232 #5 0x7f041300451c in NS_NewThread(nsIThread**, nsIRunnable*, unsigned int) xpcom/glue/nsThreadUtils.cpp:67 #6 0x7f0413135a2c in TimerThread::Init() xpcom/threads/TimerThread.cpp:92 #7 0x7f04131471b6 in nsTimerImpl::InitCommon(unsigned int, unsigned int) xpcom/threads/nsTimerImpl.cpp:327 #8 0x7f041347ae2a in mozilla::net::CacheFileIOManager::StartRemovingTrash() netwerk/cache2/CacheFileIOManager.cpp:2887 #9 0x7f041346ee9b in mozilla::net::CacheFileIOManager::CreateCacheTree() netwerk/cache2/CacheFileIOManager.cpp:3404 #10 0x7f041347049a in mozilla::net::CacheFileIOManager::OpenSpecialFileInternal(nsACString_internal const&, unsigned int, mozilla::net::CacheFileHandle**) netwerk/cache2/CacheFileIOManager.cpp:1679 #11 0x7f04134834a7 in mozilla::net::OpenFileEvent::Run() netwerk/cache2/CacheFileIOManager.cpp:594 #12 0x7f04134d02aa in mozilla::net::CacheIOThread::LoopOneLevel(unsigned int) netwerk/cache2/CacheIOThread.cpp:281 #13 0x7f04134cfa4f in mozilla::net::CacheIOThread::ThreadFunc() netwerk/cache2/CacheIOThread.cpp:211 #14 0x7f04134cebe3 in mozilla::net::CacheIOThread::ThreadFunc(void*) netwerk/cache2/CacheIOThread.cpp:158 #15 0x7f041f3a0d95 in _pt_root nsprpub/pr/src/pthreads/ptthread.c:212 #16 0x7f04228c8f6d in start_thread /build/buildd/eglibc-2.17/nptl/pthread_create.c:311 Thread T8 (Cache2 I/O) created by T0 here: #0 0x4602f5 in __interceptor_pthread_create _asan_rtl_ #1 0x7f041f39d71d in _PR_CreateThread nsprpub/pr/src/pthreads/ptthread.c:453 #2 0x7f041f39d29a in PR_CreateThread nsprpub/pr/src/pthreads/ptthread.c:544 #3 0x7f04134ceb86 in mozilla::net::CacheIOThread::Init() netwerk/cache2/CacheIOThread.cpp:46 #4 0x7f04134693af in mozilla::net::CacheFileIOManager::InitInternal() netwerk/cache2/CacheFileIOManager.cpp:1169 #5 0x7f0413469267 in mozilla::net::CacheFileIOManager::Init() netwerk/cache2/CacheFileIOManager.cpp:1155 #6 0x7f04134d1a71 in mozilla::net::CacheObserver::Observe(nsISupports*, char const*, char16_t const*) netwerk/cache2/CacheObserver.cpp:404 #7 0x7f04130a1c39 in nsObserverService::NotifyObservers(nsISupports*, char const*, char16_t const*) xpcom/ds/nsObserverList.cpp:96 #8 0x7f041885bad5 in nsXREDirProvider::DoStartup() toolkit/xre/nsXREDirProvider.cpp:804 #9 0x7f041883c88f in XREMain::XRE_mainRun() toolkit/xre/nsAppRunner.cpp:3905 #10 0x7f041883e29d in XREMain::XRE_main(int, char**, nsXREAppData const*) toolkit/xre/nsAppRunner.cpp:4088 #11 0x7f041883f0ed in XRE_main toolkit/xre/nsAppRunner.cpp:4300 #12 0x48c6e7 in main browser/app/nsBrowserApp.cpp:282 #13 0x7f04218f0de4 in __libc_start_main /build/buildd/eglibc-2.17/csu/libc-start.c:260 SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 ?? Shadow bytes around the buggy address: 0x0c0a8008fcb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0a8008fcc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0a8008fcd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0a8008fce0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0a8008fcf0: 01 fa fa fa fa fa fa fa fa fa 01 fa fa fa fa fa =>0x0c0a8008fd00: fa fa fa fa[01]fa fa fa fa fa fa fa fa fa 01 fa 0x0c0a8008fd10: fa fa fa fa fa fa fa fa fd fd fa fa fa fa fa fa 0x0c0a8008fd20: fa fa fd fd fa fa fa fa fa fa fa fa fd fd fa fa 0x0c0a8008fd30: fa fa fa fa fa fa fd fd fa fa fa fa fa fa fa fa 0x0c0a8008fd40: fd fd fa fa fa fa fa fa fa fa fd fd fa fa fa fa 0x0c0a8008fd50: fa fa fa fa fd fd fa fa fa fa fa fa fa fa fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Contiguous container OOB:fc ASan internal: fe ==12513==ABORTING

Abhishek Arya

Reporter

•

11 years ago

Attached patch r= (obsolete) — Details — Splinter Review

It can be that the chunks have a channel count of zero, so we create the resampler with 0 channels, which is wrong. This implements a more robust channel count, and delays the creation of the resampler if the whole MediaSegment is silent.

Attachment #8412586 - Flags: review?(rjesup)

Paul Adenot (:padenot)

Assignee

Updated

•

11 years ago

Assignee: nobody → paul

Status: NEW → ASSIGNED

Paul Adenot (:padenot)

Assignee

Comment 8

•

11 years ago

(clearing needinfo because I provided a patch instead)

Flags: needinfo?(paul)

Randell Jesup [:jesup] (needinfo me)

Comment 9

•

11 years ago

Comment on attachment 8412586 [details] [diff] [review] r= Review of attachment 8412586 [details] [diff] [review]: ----------------------------------------------------------------- ::: content/media/AudioSegment.h @@ +265,5 @@ > > int ChannelCount() { > NS_WARN_IF_FALSE(!mChunks.IsEmpty(), > "Cannot query channel count on a AudioSegment with no chunks."); > + // Find the first chunk that has non-zero channels. The chunk that have zero "The chunk that have" -> "A chunk that has" ::: content/media/MediaStreamGraph.cpp @@ +2275,5 @@ > } > AudioSegment* segment = static_cast<AudioSegment*>(aSegment); > + int channels = segment->ChannelCount(); > + // If this segment is just silence, we delay instanciating the resampler. > + if (!aTrackData->mResampler && channels != 0) { Don't count the channels all the time... if (!aTrackData->mResampler) { int channels = segment->ChannelCount(); if (!channels) { return; } ... This also avoids calling ResampleChunks with a null resampler, which will likely crash as it doesn't null-check. Please also add a return: if (!state) { return; } aTrackData->mResampler.own(state); to avoid ReSampleChunks if speex_resampler_init() failed.

Attachment #8412586 - Flags: review?(rjesup) → review-

Paul Adenot (:padenot)

Assignee

Comment 10

•

11 years ago

Attached patch r= — Details — Splinter Review

Addressed review comments.

Attachment #8413785 - Flags: review?(rjesup)

Paul Adenot (:padenot)

Assignee

Updated

•

11 years ago

Attachment #8412586 - Attachment is obsolete: true

Randell Jesup [:jesup] (needinfo me)

Comment 11

•

11 years ago

Comment on attachment 8413785 [details] [diff] [review] r= Review of attachment 8413785 [details] [diff] [review]: ----------------------------------------------------------------- ::: content/media/MediaStreamGraph.cpp @@ +2110,5 @@ > AudioSegment* segment = static_cast<AudioSegment*>(aSegment); > if (!aTrackData->mResampler) { > int channels = segment->ChannelCount(); > + > + // If this segment is just silence, we delay instanciating the resampler. instantiating @@ +2121,5 @@ > + if (state) { > + aTrackData->mResampler.own(state); > + } else { > + return; > + } Style nit: if (!state) { return; } aTrackData->mResampler.own(state);

Attachment #8413785 - Flags: review?(rjesup) → review+

Paul Adenot (:padenot)

Assignee

Comment 12

•

11 years ago

Comment on attachment 8413785 [details] [diff] [review] r= [Security approval request comment] How easily could an exploit be constructed based on the patch? Not easy, the crash occurs because we read bytes not allocated. Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem? Kind of, the comments can be checked-in separately. Which older supported branches are affected by this flaw? Current master (31) If not all supported branches, which bug introduced the flaw? bug 982490 Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be? N/A How likely is this patch to cause regressions; how much testing does it need? The cause is super obvious, and the fix straightforward.

Attachment #8413785 - Flags: sec-approval?

Randell Jesup [:jesup] (needinfo me)

Comment 13

•

11 years ago

Note: this will need Aurora approval, since master should be 32 now by the time this lands (likely already)

status-firefox30: --- → unaffected

status-firefox31: --- → affected

status-firefox32: --- → affected

Al Billings [:abillings - ex-MoCo]

•

11 years ago

https://hg.mozilla.org/mozilla-central/rev/8a69388a1a21

Status: ASSIGNED → RESOLVED

Closed: 11 years ago

status-firefox32: affected → fixed

Resolution: --- → FIXED

Target Milestone: --- → mozilla32

Al Billings [:abillings - ex-MoCo]

Updated

•

11 years ago

Attachment #8413785 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+

Ryan VanderMeulen [:RyanVM]

Comment 19

•

11 years ago

https://hg.mozilla.org/releases/mozilla-aurora/rev/1ea0279c3be1

status-b2g-v1.2: --- → unaffected

status-b2g-v1.3: --- → unaffected

status-b2g-v1.4: --- → unaffected

•

11 years ago

Matt, do you think this needs to be verified? Thanks!

Flags: needinfo?(mwobensmith)

Matt Wobensmith [:mwobensmith][:matt:]

Comment 21

•

11 years ago

(In reply to Liz Henry :lizzard from comment #20) > Matt, do you think this needs to be verified? Thanks! Yes, indeed. It will require an ASan build.

Flags: needinfo?(mwobensmith)

Paul Adenot (:padenot)

Assignee

Comment 22

•

11 years ago

Get one here, for your platform: https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/

u279076

Comment 23

•

11 years ago

Otilia can you please have someone on your team test this?

Keywords: verifyme

Matt Wobensmith [:mwobensmith][:matt:]

Comment 24

•

11 years ago

Unable to reproduce on ASan build from 2014-04-18, as well as post-checkin on a build from 2014-07-02. So, while we confirm that we don't see a crash, we still have to mark [qa-] with regards to verification. Abhishek, if you can confirm that this is fixed for you, that would be helpful in any case.

Keywords: verifyme

Whiteboard: [qa-]

Abhishek Arya

Reporter

Comment 25

•

10 years ago

(In reply to Matt Wobensmith from comment #24) > Unable to reproduce on ASan build from 2014-04-18, as well as post-checkin > on a build from 2014-07-02. So, while we confirm that we don't see a crash, > we still have to mark [qa-] with regards to verification. > > Abhishek, if you can confirm that this is fixed for you, that would be > helpful in any case. Does not reproduce anymore on trunk.

BMO Automation

Updated

•

9 years ago

Group: core-security → core-security-release

Daniel Veditz [:dveditz]

Updated

•

9 years ago

Group: core-security-release

Testcase, run the html file in archive 11 years ago Abhishek Arya 7.37 MB, application/x-zip-compressed		Details
r= 11 years ago Paul Adenot (:padenot) 3.25 KB, patch	jesup : review-	Details \| Diff \| Splinter Review
r= 11 years ago Paul Adenot (:padenot) 3.75 KB, patch	jesup : review+ abillings : approval-mozilla-aurora+	Details \| Diff \| Splinter Review