Closed Bug 1698946 Opened 4 years ago Closed 3 years ago

Invalid Win32k use in content process [xul!gfxWindowsPlatform::SetupClearTypeParams]

Categories

(Core :: Security: Process Sandboxing, defect, P2)

All
Windows
defect

Tracking

()

RESOLVED FIXED
92 Branch
Tracking Status
firefox92 --- fixed

People

(Reporter: cmartin, Assigned: bobowen)

References

(Blocks 1 open bug, Regressed 1 open bug)

Details

Attachments

(4 files)

00 0000006b`807fbee8 00007fff`9c54726a win32u!NtUserEnumDisplayDevices
01 0000006b`807fbef0 00007fff`8d56376a USER32!EnumDisplayDevicesW+0x6a
02 0000006b`807fc2c0 00007fff`8d563649 dwrite!DWriteRenderingParams::CreateRenderingParamsFromDeviceName+0xf6
03 0000006b`807fc720 00007fff`8d563ab7 dwrite!DWriteRenderingParams::Create+0x19
04 0000006b`807fc750 00007fff`285ebe4a dwrite!DWriteFactory::CreateRenderingParamsInternal+0x47
05 0000006b`807fc7c0 00007fff`285eb1b6 xul!gfxWindowsPlatform::SetupClearTypeParams+0x21a [c:\moz\mozilla-central\gfx\thebes\gfxWindowsPlatform.cpp @ 1155] 
06 (Inline Function) --------`-------- xul!gfxWindowsPlatform::InitDWriteSupport+0x51 [c:\moz\mozilla-central\gfx\thebes\gfxWindowsPlatform.cpp @ 407] 
07 0000006b`807fc9b0 00007fff`285e1192 xul!gfxWindowsPlatform::InitAcceleration+0x146 [c:\moz\mozilla-central\gfx\thebes\gfxWindowsPlatform.cpp @ 347] 
08 0000006b`807fca80 00007fff`285e1a7a xul!gfxPlatform::Init+0xa22 [c:\moz\mozilla-central\gfx\thebes\gfxPlatform.cpp @ 919] 
09 0000006b`807fcc40 00007fff`29c2a67c xul!gfxPlatform::InitChild+0x1a [c:\moz\mozilla-central\gfx\thebes\gfxPlatform.cpp @ 496] 
0a (Inline Function) --------`-------- xul!mozilla::dom::ContentChild::InitGraphicsDeviceData+0x8 [c:\moz\mozilla-central\dom\ipc\ContentChild.cpp @ 1213] 
0b 0000006b`807fcc70 00007fff`27ee39a5 xul!mozilla::dom::ContentChild::RecvSetXPCOMProcessAttributes+0x1bc [c:\moz\mozilla-central\dom\ipc\ContentChild.cpp @ 631]
00 0000006b`807fc428 00007fff`9c5436de win32u!NtUserSystemParametersInfo
01 0000006b`807fc430 00007fff`972af0a1 USER32!RealSystemParametersInfoW+0xae
02 0000006b`807fc4c0 00007fff`972aaea6 UxTheme!ClassicSystemParametersInfoW+0x41 [shell\themes\uxtheme\sethook.cpp @ 1556] 
03 (Inline Function) --------`-------- UxTheme!_InternalSystemParametersInfo+0x10 [shell\themes\uxtheme\nctheme.cpp @ 8190] 
04 0000006b`807fc500 00007fff`9c54337a UxTheme!ThemeSystemParametersInfoW+0xb6 [shell\themes\uxtheme\sethook.cpp @ 1476] 
05 0000006b`807fc5f0 00007fff`8d563d0d USER32!SystemParametersInfoW+0x9a
06 0000006b`807fc640 00007fff`8d563bff dwrite!DWriteRenderingParams::DetermineCompatibleSmoothingMode+0x21
07 0000006b`807fc670 00007fff`8d54bf9d dwrite!DWriteRenderingParams::DWriteRenderingParams+0x2b
08 0000006b`807fc6d0 00007fff`8d54bee6 dwrite!ComObject<DWriteRenderingParams,DeleteOnZeroReference>::ComObject<DWriteRenderingParams,DeleteOnZeroReference><float & __ptr64,float & __ptr64,float & __ptr64,float & __ptr64,enum DWRITE_PIXEL_GEOMETRY & __ptr64,enum DWRITE_RENDERING_MODE1 & __ptr64,bool,enum DWRITE_GRID_FIT_MODE & __ptr64>+0x71
09 0000006b`807fc730 00007fff`285ec293 dwrite!DWriteFactory::CreateCustomRenderingParams+0x106
0a 0000006b`807fc7c0 00007fff`285eb1b6 xul!gfxWindowsPlatform::SetupClearTypeParams+0x663 [c:\moz\mozilla-central\gfx\thebes\gfxWindowsPlatform.cpp @ 1215] 
0b (Inline Function) --------`-------- xul!gfxWindowsPlatform::InitDWriteSupport+0x51 [c:\moz\mozilla-central\gfx\thebes\gfxWindowsPlatform.cpp @ 407] 
0c 0000006b`807fc9b0 00007fff`285e1192 xul!gfxWindowsPlatform::InitAcceleration+0x146 [c:\moz\mozilla-central\gfx\thebes\gfxWindowsPlatform.cpp @ 347] 
0d 0000006b`807fca80 00007fff`285e1a7a xul!gfxPlatform::Init+0xa22 [c:\moz\mozilla-central\gfx\thebes\gfxPlatform.cpp @ 919] 
0e 0000006b`807fcc40 00007fff`29c2a67c xul!gfxPlatform::InitChild+0x1a [c:\moz\mozilla-central\gfx\thebes\gfxPlatform.cpp @ 496] 
0f (Inline Function) --------`-------- xul!mozilla::dom::ContentChild::InitGraphicsDeviceData+0x8 [c:\moz\mozilla-central\dom\ipc\ContentChild.cpp @ 1213] 
10 0000006b`807fcc70 00007fff`27ee39a5 xul!mozilla::dom::ContentChild::RecvSetXPCOMProcessAttributes+0x1bc [c:\moz\mozilla-central\dom\ipc\ContentChild.cpp @ 631] 
00 0000006b`807fc428 00007fff`9c5436de win32u!NtUserSystemParametersInfo
01 0000006b`807fc430 00007fff`972af0a1 USER32!RealSystemParametersInfoW+0xae
02 0000006b`807fc4c0 00007fff`972aaea6 UxTheme!ClassicSystemParametersInfoW+0x41 [shell\themes\uxtheme\sethook.cpp @ 1556] 
03 (Inline Function) --------`-------- UxTheme!_InternalSystemParametersInfo+0x10 [shell\themes\uxtheme\nctheme.cpp @ 8190] 
04 0000006b`807fc500 00007fff`9c54337a UxTheme!ThemeSystemParametersInfoW+0xb6 [shell\themes\uxtheme\sethook.cpp @ 1476] 
05 0000006b`807fc5f0 00007fff`8d563d0d USER32!SystemParametersInfoW+0x9a
06 0000006b`807fc640 00007fff`8d563bff dwrite!DWriteRenderingParams::DetermineCompatibleSmoothingMode+0x21
07 0000006b`807fc670 00007fff`8d54bf9d dwrite!DWriteRenderingParams::DWriteRenderingParams+0x2b
08 0000006b`807fc6d0 00007fff`8d54bee6 dwrite!ComObject<DWriteRenderingParams,DeleteOnZeroReference>::ComObject<DWriteRenderingParams,DeleteOnZeroReference><float & __ptr64,float & __ptr64,float & __ptr64,float & __ptr64,enum DWRITE_PIXEL_GEOMETRY & __ptr64,enum DWRITE_RENDERING_MODE1 & __ptr64,bool,enum DWRITE_GRID_FIT_MODE & __ptr64>+0x71
09 0000006b`807fc730 00007fff`285ec34f dwrite!DWriteFactory::CreateCustomRenderingParams+0x106
0a 0000006b`807fc7c0 00007fff`285eb1b6 xul!gfxWindowsPlatform::SetupClearTypeParams+0x71f [c:\moz\mozilla-central\gfx\thebes\gfxWindowsPlatform.cpp @ 1222] 
0b (Inline Function) --------`-------- xul!gfxWindowsPlatform::InitDWriteSupport+0x51 [c:\moz\mozilla-central\gfx\thebes\gfxWindowsPlatform.cpp @ 407] 
0c 0000006b`807fc9b0 00007fff`285e1192 xul!gfxWindowsPlatform::InitAcceleration+0x146 [c:\moz\mozilla-central\gfx\thebes\gfxWindowsPlatform.cpp @ 347] 
0d 0000006b`807fca80 00007fff`285e1a7a xul!gfxPlatform::Init+0xa22 [c:\moz\mozilla-central\gfx\thebes\gfxPlatform.cpp @ 919] 
0e 0000006b`807fcc40 00007fff`29c2a67c xul!gfxPlatform::InitChild+0x1a [c:\moz\mozilla-central\gfx\thebes\gfxPlatform.cpp @ 496] 
0f (Inline Function) --------`-------- xul!mozilla::dom::ContentChild::InitGraphicsDeviceData+0x8 [c:\moz\mozilla-central\dom\ipc\ContentChild.cpp @ 1213] 
10 0000006b`807fcc70 00007fff`27ee39a5 xul!mozilla::dom::ContentChild::RecvSetXPCOMProcessAttributes+0x1bc [c:\moz\mozilla-central\dom\ipc\ContentChild.cpp @ 631] 
Assignee: nobody → cmartin
Status: NEW → ASSIGNED
Blocks: 1383524
No longer blocks: win32k-lockdown
Severity: -- → S4
Priority: -- → P2
Assignee: cmartin → bobowencode

This provides settings, which are populated from gfxVars retrieved in the
parent, so that they can be used in all processes.
IDWriteRenderingParams are created lazily, so that we don't try and create them
in processes that have win32k locked fown why the API calls will fail.

Depends on D120596

Depends on D120597

Depends on D120598

Blocks: 1711553
Pushed by bobowencode@gmail.com: https://hg.mozilla.org/integration/autoland/rev/ee3a3769b412 p1: Add and maintain ClearType parameters gfxVars. r=jfkthame https://hg.mozilla.org/integration/autoland/rev/6bc4a4c1b5e1 p2: Add DWriteSettings to be used to retrieve font settings. r=jfkthame https://hg.mozilla.org/integration/autoland/rev/159a07262a09 p3: Change existing code to use DWriteSettings. r=jfkthame https://hg.mozilla.org/integration/autoland/rev/dc5761625593 p4: Remove remaining old ClearType parameters code. r=jfkthame
Blocks: 1698947
Regressions: 1726744
Regressions: 1733105
Regressions: 1743273
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: