VULNERABILITY DETAILS

There is a heap-based buffer overflow (memory write) in gpu::gles2::GLES2Implementation::ReadPixels.

The attached testcase crashes the latest ASAN build of Chrome on Windows 10 as follows (the complete stack trace can be found in asan.txt):

=================================================================
==2556==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x23375a40 at pc 0x015500cc bp 0x0096a354 sp 0x0096a344
WRITE of size 1000000 at 0x23375a40 thread T0
    #0 0x15500e6 in __asan_memcpy e:\b\build\slave\win_upload_clang\build\src\third_party\llvm\projects\compiler-rt\lib\asan\asan_interceptors.cc:462
    #1 0x14ceaf52 in gpu::gles2::GLES2Implementation::ReadPixels(int,int,int,int,unsigned int,unsigned int,void *) C:\b\c\b\win_asan_release\src\gpu\command_buffer\client\gles2_implementation.cc:4158:7
..

The arguments to memcpy are as follows (see WinDbg_Chrome_Stable.txt for more details):
  - src  : canvas pixel (framebuffer) data (user-controlled)
  - dest : heap-based buffer (pixels array) + unchecked offset (user-controlled)
  - count: canvas width * canvas height * 4 (user-controlled)

This bug is obviously exploitable for remote code execution.
  
To reliably trigger a crash, the width and height of the canvas are set to the value 500. This results in a value of 1000000 (500 * 500 * 4) bytes to copy (see the second line of the ASAN output 'WRITE of size 1000000 ..').

Relevant source code snippets (see the comments inline marked with ###):

See https://cs.chromium.org/chromium/src/third_party/WebKit/Source/platform/graphics/gpu/DrawingBuffer.cpp:

..
1056 bool DrawingBuffer::PaintRenderingResultsToImageData(
1057     int& width,
1058     int& height,
1059     SourceDrawingBuffer source_buffer,
1060     WTF::ArrayBufferContents& contents) {
1061   ScopedStateRestorer scoped_state_restorer(this);
1062
1063   DCHECK(!premultiplied_alpha_);
1064   width = Size().Width();
1065   height = Size().Height();
1066
1067   CheckedNumeric<int> data_size = 4;
1068   data_size *= width;
1069   data_size *= height;
1070   if (!data_size.IsValid())
1071     return false;
1072
1073   WTF::ArrayBufferContents pixels(width * height, 4,   ### allocation of the heap-based destination buffer    
1074                                   WTF::ArrayBufferContents::kNotShared,
1075                                   WTF::ArrayBufferContents::kDontInitialize);
..

See https://cs.chromium.org/chromium/src/gpu/command_buffer/client/gles2_implementation.cc:

..
4001 void GLES2Implementation::ReadPixels(
4002    GLint xoffset, GLint yoffset, GLsizei width, GLsizei height, GLenum format,
4003    GLenum type, void* pixels) {
..
4106  // Advance pixels pointer past the skip rows and skip pixels
4107  dest += skip_size;   ### heap-based destination buffer + unchecked user-controlled offset
..
4153    if (padded_row_size == unpadded_row_size &&
4154       (pack_row_length_ == 0 || pack_row_length_ == width) &&
4155       result->row_length == width && result->num_rows == num_rows) {
4156     // The pixels are tightly packed.
4157     uint32_t copy_size = unpadded_row_size * num_rows;
4158     memcpy(dest, src, copy_size);   ### heap buffer overflow
..


VERSION

Tested on: 

- Chrome Stable Version 59.0.3071.115 (64-Bit, Windows 10)
- asan-win32-release-485195


REPRODUCTION CASE

Provided files:

- testcase.html            -- Minimal testcase to trigger the issue.
- asan.txt                 -- Detailed ASAN output (Windows 10).
- WinDbg_Chrome_Stable.txt -- Further debugging information (Chrome Stable on Windows 10).


FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION

Type of crash: tab
 

Deleted: testcase.html 623 bytes

testcase.html 623 bytes View Download

Deleted: asan.txt 7.6 KB

asan.txt 7.6 KB View Download

Deleted: WinDbg_Chrome_Stable.txt 12.2 KB

WinDbg_Chrome_Stable.txt 12.2 KB View Download