Closed Bug 510956 Opened 15 years ago Closed 15 years ago

Crash [@ nsXMLElement::GetOwnerDocument] with getScreenCTM

Categories

(Core :: Graphics, defect)

Product:
Core
Component:
Graphics
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: jruderman, Unassigned)

References

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(2 files)

testcase (crashes Firefox when loaded)
(deleted), image/svg+xml
Details
stack trace
(deleted), text/plain
Details
Attached image testcase (crashes Firefox when loaded) (deleted) — 
      No description provided.
Attached file stack trace (deleted) — 

    
    

    
  
on windows i crash with given testcase @ _moz_cairo_matrix_multiply which seems to be Bug 508247.
=> bp-196f8d58-7968-44ac-98a6-2f5d22090817

    
  
Depends on: 508247
Component: SVG → Graphics
QA Contact: general → thebes

    
    

    
  
according to the stack this is null deref with small offset so it doesn't seem exploitable with current technology.

    
    

    
  
Fixed by check in for bug 508247
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
Crash Signature: [@ nsXMLElement::GetOwnerDocument]

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: