New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 120189 link

Starred by 0 users

Issue metadata

Status: Fixed
Owner:
Closed: Mar 2012
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 1
Type: Bug-Security

Restricted
  • Only users with EditIssue permission may comment.



Sign in to add a comment

Heap-use-after-free in WebCore::V8RecursionScope::didLeaveScriptContext

Project Member Reported by infe...@chromium.org, Mar 26 2012

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=30637316

Fuzzer: Inferno_layout_test_fuzzer

Crash Type: Heap-use-after-free READ 8
Crash Address: 0x7fb0b7b2c158
Crash State:
  - crash stack -
  WebCore::V8RecursionScope::didLeaveScriptContext
  WebCore::V8Proxy::instrumentedCallFunction
  - free stack -
  WebCore::ScriptController::executeIfJavaScriptURL
  WebCore::SubframeLoader::requestFrame
  
Regressed: https://cluster-fuzz.appspot.com/revisions?range=121128:121411

Minimized Testcase (0.68 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94tSTuHVxlXN6uj2GiWdvPB1VtkOaiEL6NLvoM2ZqTCHc_xwbbcUn1ImDjbKmgbCpPVV1OsWix-4qj3bCuEiv6DpHUQNFmog1SCgtkc6CL9qXT7VQ5QvAwkkLCyW4Vrpq2MqKgx3U9BEjCSzEC4YkTE-3lf-A
 
Cc: dslomov@chromium.org
Owner: adamk@chromium.org
Status: Assigned
Looks like a regression from https://trac.webkit.org/changeset/107170/. We did merge that changeset to m18. Checking with Karen if mutation observers will be on on m18 stable. on m18 beta, it was.

Comment 2 by adamk@chromium.org, Mar 26 2012

Status: Started
This looks straightforward to fix, patch uploaded to http://wkb.ug/82222

Comment 3 by adamk@chromium.org, Mar 26 2012

Status: FixUnreleased
http://trac.webkit.org/changeset/112161
Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify Merge-Approved
Labels: SecImpacts-Stable
So this is SecImpacts-Stable as of Weds. Not a huge deal, we'll have an M18 patch going out pretty soon.
Project Member

Comment 6 by ClusterFuzz, Mar 28 2012

ClusterFuzz has detected this issue as fixed in range 129088:129159.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=30637316

Fuzzer: Inferno_layout_test_fuzzer

Crash Type: Heap-use-after-free READ 8
Crash Address: 0x7fb0b7b2c158
Crash State:
  - crash stack -
  WebCore::V8RecursionScope::didLeaveScriptContext
  WebCore::V8Proxy::instrumentedCallFunction
  - free stack -
  WebCore::ScriptController::executeIfJavaScriptURL
  WebCore::SubframeLoader::requestFrame
  
Regressed: https://cluster-fuzz.appspot.com/revisions?range=121128:121411
Fixed: https://cluster-fuzz.appspot.com/revisions?range=129088:129159

Minimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94tSTuHVxlXN6uj2GiWdvPB1VtkOaiEL6NLvoM2ZqTCHc_xwbbcUn1ImDjbKmgbCpPVV1OsWix-4qj3bCuEiv6DpHUQNFmog1SCgtkc6CL9qXT7VQ5QvAwkkLCyW4Vrpq2MqKgx3U9BEjCSzEC4YkTE-3lf-A

If you suspect that the result above is incorrect, try re-doing that job on the testcase report page.
Labels: -SecSeverity-High -Merge-Approved SecSeverity-Medium Merge-Merged
Looks like it's just a read-after-free of a boolean? Going with medium.

M18: http://trac.webkit.org/changeset/112631
Labels: -SecSeverity-Medium SecSeverity-High
No stale ScriptExecutionContext. Reverting back to High.
Labels: CVE-2011-3077

Comment 10 by cdn@chromium.org, May 15 2012

Status: Fixed
Marking old security bugs Fixed..
Project Member

Comment 11 by bugdroid1@chromium.org, Oct 13 2012

Labels: Restrict-AddIssueComment-Commit
This issue has been closed for some time. No one will pay attention to new comments.
If you are seeing this bug or have new data, please click New Issue to start a new bug.
Project Member

Comment 12 by bugdroid1@chromium.org, Mar 10 2013

Labels: -Area-WebKit -Type-Security -SecSeverity-High -SecImpacts-Beta -Mstone-18 -Stability-AddressSanitizer -SecImpacts-Stable Cr-Content Security-Impact-Beta Type-Bug-Security M-18 Security-Severity-High Security-Impact-Stable Performance-Memory-AddressSanitizer
Project Member

Comment 13 by bugdroid1@chromium.org, Mar 13 2013

Labels: Restrict-View-EditIssue
Project Member

Comment 14 by bugdroid1@chromium.org, Mar 13 2013

Labels: -Restrict-AddIssueComment-Commit Restrict-AddIssueComment-EditIssue
Labels: -Restrict-View-SecurityNotify -Restrict-View-EditIssue
Project Member

Comment 16 by bugdroid1@chromium.org, Mar 21 2013

Labels: -Security-Severity-High Security_Severity-High
Project Member

Comment 17 by bugdroid1@chromium.org, Mar 21 2013

Labels: -Security-Impact-Stable Security_Impact-Stable
Project Member

Comment 18 by bugdroid1@chromium.org, Mar 21 2013

Labels: -Security-Impact-Beta Security_Impact-Beta
Project Member

Comment 19 by bugdroid1@chromium.org, Apr 1 2013

Labels: -Performance-Memory-AddressSanitizer Stability-Memory-AddressSanitizer
Project Member

Comment 20 by bugdroid1@chromium.org, Apr 6 2013

Labels: -Cr-Content Cr-Blink
Project Member

Comment 21 by sheriffbot@chromium.org, Jun 14 2016

Labels: -security_impact-beta
Project Member

Comment 22 by sheriffbot@chromium.org, Oct 1 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 23 by sheriffbot@chromium.org, Oct 2 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: allpublic
Labels: CVE_description-submitted

Sign in to add a comment