Closed Bug 1839601 Opened 1 year ago Closed 1 year ago

Firefox Tab Crash MOZ_CRASH() [@ mozilla::gfx::DrawTargetRecording::CreateSimilarDrawTarget]

Categories

(Core :: Graphics, defect)

Product:
Core
Component:
Graphics
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1757003

People

(Reporter: fazim.pentester, Unassigned)

Details

(Keywords: crash, testcase, Whiteboard: [reporter-external] [client-bounty-form] [verif?])

Crash Data

Attachments

(1 file)

screenshot.png
(deleted), image/png
Details
Attached image screenshot.png (deleted) —

The code below causes the tab to crash. I have tried the latest version of ASan Nightly Nightly, but it did not capture any traces.

<!DOCTYPE html>
<html>

<head>
  <style>
    textarea {
      mask: conic-gradient(at 94% 100%, blue 0% 100%) 66em 75% repeat repeat padding-box luminance;
      border-right-style: inset;
      background-clip: text;
    }
  </style>
</head>

<body>
  <textarea cols="9999"></textarea>
</body>

</html>
Flags: sec-bounty?
Summary: Mozilla Tab Crash (Reason: Unknown) → Firefox Tab Crash (Reason: Unknown)

Is this a security bug, or the browser just gave up on my shenanigans

I can reproduce on 115 beta by copy-pasting the string from comment 0 into https://jsbin.com - https://crash-stats.mozilla.org/report/index/e877f248-25b2-48fd-ad69-2ab3c0230621 .

https://searchfox.org/mozilla-central/rev/4e8f62a231e71dc53eb50b6d74afca21d6b254e9/gfx/2d/DrawTargetRecording.cpp#623-630

I think this is a safe tab crash given the MOZ_CRASH call, so not sure it needs to be sec-sensitive, though I guess it's a DoS vector given the reproducible testcase. Hopefully the graphics team can clarify further.

Group: firefox-core-security → gfx-core-security
Crash Signature: [@ mozilla::gfx::DrawTargetRecording::CreateSimilarDrawTarget ]
Component: Security → Graphics
Keywords: crash, testcase
Product: Firefox → Core
Summary: Firefox Tab Crash (Reason: Unknown) → Firefox Tab Crash MOZ_CRASH() [@ mozilla::gfx::DrawTargetRecording::CreateSimilarDrawTarget]

Jeff, do you know who would be the right person to investigate / fix this? Do we think it needs to remain as a sec-bug?

Flags: needinfo?(jmuizelaar)
Severity: -- → S2

I don't think this is a security bug. It seems like a dup of 1757003

Status: NEW → RESOLVED
Closed: 1 year ago
Duplicate of bug: 1757003
Flags: needinfo?(jmuizelaar)
Resolution: --- → DUPLICATE
Group: gfx-core-security
Severity: S2 → --
Flags: sec-bounty? → sec-bounty-
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: