Closed
Bug 1477493
Opened 6 years ago
Closed 6 years ago
AddressSanitizer: stack-use-after-scope [@ __interceptor_strcmp] with READ of size 1 in libglapi through [@ LookupSymbol]
Categories
(Core :: Graphics, defect, P3)
Tracking
()
RESOLVED
FIXED
People
(Reporter: decoder, Assigned: jgilbert)
References
(Blocks 1 open bug)
Details
(Keywords: crash, regression, sec-vector)
Attachments
(3 files)
The attached crash information was submitted via the ASan Nightly Reporter on mozilla-central-asan-nightly revision 63.0a1-20180721100146-https://hg.mozilla.org/mozilla-central/rev/9daa53881b7ae80bf6b093dac5d7744cf7fd18b1.
For detailed crash information, see attachment.
Marking s-s because this could be a security problem, though the actual problem could be in Mesa/libglapi.
Reporter | ||
Comment 1•6 years ago
|
||
Updated•6 years ago
|
Group: core-security → gfx-core-security
Assignee | ||
Comment 2•6 years ago
|
||
This is likely fairly safe, though probably bone-headed. I can take a closer look tomorrow.
Assignee: nobody → jgilbert
Updated•6 years ago
|
Flags: needinfo?(jgilbert)
Assignee | ||
Comment 3•6 years ago
|
||
...Monday it is!
Reporter | ||
Updated•6 years ago
|
No longer blocks: asan-nightly-project
Assignee | ||
Comment 4•6 years ago
|
||
I can't repro.
It feels like this might be:
https://bugs.freedesktop.org/show_bug.cgi?id=81992
Fixed by:
https://cgit.freedesktop.org/mesa/mesa/commit/?id=1110113a7f0b6f9b21dd26dee8e95a021041c71c
Do we have an about:support or driver version info for affected systems?
Flags: needinfo?(jgilbert) → needinfo?(choller)
Reporter | ||
Comment 5•6 years ago
|
||
Forwarding needinfo to the original reporter.
Can you provide information as requested in comment 5? Thanks!
Flags: needinfo?(choller) → needinfo?(timhabigt)
Comment 6•6 years ago
|
||
Flags: needinfo?(timhabigt)
Comment 7•6 years ago
|
||
Output of glxinfo
Assignee | ||
Comment 8•6 years ago
|
||
If you update Mesa, does this error go away?
10.5+ should be fixed.
Flags: needinfo?(timhabigt)
Comment 9•6 years ago
|
||
I could reproduce the error reliably. I will upgrade Mesa and try again.
Assignee | ||
Comment 10•6 years ago
|
||
Also, does this cause any errors outside of the ASAN assert?
Comment 11•6 years ago
|
||
I got the "Your tab just crashed" error message.
After upgrading Mesa to version 11.2.0, I can no longer reproduce the crash.
Flags: needinfo?(timhabigt)
Assignee | ||
Comment 12•6 years ago
|
||
Ok, great!
I'm hoping we can open this bug and expect ASAN build users to update Mesa if they run into this.
Alternatively, is there a whitelist we can add this issue to?
:decoder?
Flags: needinfo?(choller)
Reporter | ||
Comment 13•6 years ago
|
||
There is unfortunately no whitelist, but I can filter for this issue on the server that receives the reports so reports from users that haven't upgraded won't hurt.
Flags: needinfo?(choller)
Updated•6 years ago
|
Priority: -- → P3
Updated•6 years ago
|
Group: gfx-core-security
Status: NEW → RESOLVED
Closed: 6 years ago
Keywords: sec-vector
Resolution: --- → FIXED
Updated•6 years ago
|
status-firefox63:
affected → ---
Assignee | ||
Comment 14•6 years ago
|
||
NB: Mesa 10.5 was released in early 2015.
Since this was a bug in Mesa and not in Firefox, changing the status to INVALID.
Resolution: FIXED → INVALID
decoder would prefer to leave sec-vector issues as FIXED.
Resolution: INVALID → FIXED
Updated•5 years ago
|
Blocks: asan-maintenance
You need to log in
before you can comment on or make changes to this bug.
Description
•