Bug: ASAN: heap-buffer-overflow in Id (include/mozilla/ipc/ProtocolUtils.h:229:31)
Status: RESOLVED
Priority: --
Resolution: INVALID
Created: 2020-05-07 00:00:38+00:00
Resolved: 2024-05-30 17:14:09+00:00

Whilst fuzzing Firefox Nightly ASAN built by Mozilla (Build ID 20200506093716), a heap-buffer-overflow was discovered. My platform is Fedora 31 on an Intel CPU with an Nvidia RTX 2070. 

Prefs in use:
```
user_pref("gfx.webrender.all", true);
user_pref("fission.autostart", true);
user_pref("fission.preserve_browsing_contexts", true);
user_pref("fission.sessionHistoryInParent", true);
user_pref("layers.advanced.fission.enabled", true);
```

In the console, this is seen:
```
*** You are running in chaos test mode. See ChaosMode.h. ***
Assertion failure: false (Trying to update a child BrowsingContext in another child process), at /builds/worker/checkouts/gecko/dom/ipc/ContentParent.cpp:5868
#01: ???[/home/geeknik/firefox/libxul.so +0x39f53fb]
#02: ???[/home/geeknik/firefox/libxul.so +0x379f947]
#03: ???[/home/geeknik/firefox/libxul.so +0x379bc38]
#04: ???[/home/geeknik/firefox/libxul.so +0x379d8ea]
#05: ???[/home/geeknik/firefox/libxul.so +0x379df18]
#06: ???[/home/geeknik/firefox/libxul.so +0x2595784]
#07: ???[/home/geeknik/firefox/libxul.so +0x259e672]
#08: ???[/home/geeknik/firefox/libxul.so +0x37a70ee]
#09: ???[/home/geeknik/firefox/libxul.so +0x36bb153]
#10: ???[/home/geeknik/firefox/libxul.so +0xac5fa1b]
#11: ???[/home/geeknik/firefox/libxul.so +0xe93685f]
#12: ???[/home/geeknik/firefox/libxul.so +0xeb9489e]
#13: ???[/home/geeknik/firefox/libxul.so +0xeb96d17]
#14: ???[/home/geeknik/firefox/libxul.so +0xeb97911]
#15: ???[/home/geeknik/firefox/firefox +0xf43fe]
#16: __libc_start_main[/lib64/libc.so.6 +0x271a3]
#17: ???[/home/geeknik/firefox/firefox +0x489a9]
AddressSanitizer:DEADLYSIGNAL
Exiting due to channel error.
Exiting due to channel error.
```

From the ASAN log:
```
==671384==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60e000360d58 at pc 0x7f9cf7bd7557 bp 0x7ffc7ac62a30 sp 0x7ffc7ac62a28
READ of size 4 at 0x60e000360d58 thread T0 (file:// Content)
    #0 0x7f9cf7bd7556 in Id /builds/worker/workspace/obj-build/dist/include/mozilla/ipc/ProtocolUtils.h:229:31
    #1 0x7f9cf7bd7556 in mozilla::ipc::IPDLParamTraits<mozilla::dom::PSHEntryChild*>::Write(IPC::Message*, mozilla::ipc::IProtocol*, mozilla::dom::PSHEntryChild* const&) /builds/worker/workspace/obj-build/ipc/ipdl/PSHEntryChild.cpp:3512:20
    #2 0x7f9cf771a714 in mozilla::dom::PContentChild::SendUpdateSHEntriesInBC(mozilla::dom::PSHEntryChild*, mozilla::dom::PSHEntryChild*, mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:7134:5
    #3 0x7f9d01d091a7 in nsDocShell::SetHistoryEntryAndUpdateBC(mozilla::Maybe<nsISHEntry*> const&, mozilla::Maybe<nsISHEntry*> const&) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:11085:9
    #4 0x7f9d01d32c32 in nsDocShell::HandleSameDocumentNavigation(nsDocShellLoadState*, nsDocShell::SameDocumentNavigationState&) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:8400:3
    #5 0x7f9d01ca6666 in nsDocShell::InternalLoad(nsDocShellLoadState*, nsIDocShell**, nsIRequest**) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:8741:12
    #6 0x7f9d01cdca0d in nsDocShell::LoadURI(nsDocShellLoadState*, bool) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:807:10
    #7 0x7f9d01ca31b4 in mozilla::dom::BrowsingContext::LoadURI(nsDocShellLoadState*, bool) /builds/worker/checkouts/gecko/docshell/base/BrowsingContext.cpp:1429:23
    #8 0x7f9cf9c20397 in mozilla::dom::LocationBase::SetURI(nsIURI*, nsIPrincipal&, mozilla::ErrorResult&, bool) /builds/worker/checkouts/gecko/dom/base/LocationBase.cpp:144:21
    #9 0x7f9cf9c1fd9a in mozilla::dom::Location::SetHash(nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/Location.cpp:173:3
    #10 0x7f9cfa463b58 in mozilla::dom::Location_Binding::set_hash(JSContext*, JS::Handle<JSObject*>, void*, JSJitSetterCallArgs) /builds/worker/workspace/obj-build/dom/bindings/LocationBinding.cpp:912:24
    #11 0x7f9cfc07e9cf in bool mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::MaybeCrossOriginObjectThisPolicy>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3151:8
    #12 0x7f9d02b9f857 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:493:13
    #13 0x7f9d02b9f857 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:585:12
    #14 0x7f9d02ba5274 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:648:10
    #15 0x7f9d02ba5274 in Call /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:665:8
    #16 0x7f9d02ba5274 in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:803:10
    #17 0x7f9d02ddd398 in js::SetPropertyIgnoringNamedGetter(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyDescriptor>, JS::ObjectOpResult&) /builds/worker/checkouts/gecko/js/src/proxy/BaseProxyHandler.cpp:227:8
    #18 0x7f9cfc0a8de1 in mozilla::dom::DOMProxyHandler::set(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) const /builds/worker/checkouts/gecko/dom/bindings/DOMJSProxyHandler.cpp:243:10
    #19 0x7f9cfa3ce7f0 in mozilla::dom::Location_Binding::DOMProxyHandler::set(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) const /builds/worker/workspace/obj-build/dom/bindings/LocationBinding.cpp:1752:32
    #20 0x7f9d02dfcefb in setInternal /builds/worker/checkouts/gecko/js/src/proxy/Proxy.cpp:382:19
    #21 0x7f9d02dfcefb in js::Proxy::set(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /builds/worker/checkouts/gecko/js/src/proxy/Proxy.cpp:390:10
    #22 0x7f9d03e08b6f in SetProperty /builds/worker/checkouts/gecko/js/src/vm/ObjectOperations-inl.h:280:12
    #23 0x7f9d03e08b6f in js::jit::DoSetPropFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICSetProp_Fallback*, JS::Value*, JS::Handle<JS::Value>, JS::Handle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jit/BaselineIC.cpp:2791:10
    #24 0x3c421e787e39  (<unknown module>)

0x60e000360d58 is located 40 bytes to the left of 160-byte region [0x60e000360d80,0x60e000360e20)
allocated by thread T0 (file:// Content) here:
    #0 0x562d5ecc836d in malloc /builds/worker/fetches/llvm-project/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:145:3
    #1 0x562d5ecfdddd in moz_xmalloc /builds/worker/checkouts/gecko/memory/mozalloc/mozalloc.cpp:52:15
    #2 0x7f9d01d9d0be in operator new /builds/worker/workspace/obj-build/dist/include/mozilla/cxxalloc.h:33:10
    #3 0x7f9d01d9d0be in mozilla::dom::CreateSHEntryForDocShell(nsISHistory*) /builds/worker/checkouts/gecko/docshell/shistory/ChildSHistory.cpp:126:32
    #4 0x7f9d01d40383 in nsDocShell::AddToSessionHistory(nsIURI*, nsIChannel*, nsIPrincipal*, nsIPrincipal*, nsIPrincipal*, nsIContentSecurityPolicy*, bool, nsISHEntry**) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:10780:13
    #5 0x7f9d01d2e775 in nsDocShell::OnNewURI(nsIURI*, nsIChannel*, nsIPrincipal*, nsIPrincipal*, nsIPrincipal*, unsigned int, nsIContentSecurityPolicy*, bool, bool, bool) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:10263:13
    #6 0x7f9d01d33360 in nsDocShell::HandleSameDocumentNavigation(nsDocShellLoadState*, nsDocShell::SameDocumentNavigationState&) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:8434:3
    #7 0x7f9d01ca6666 in nsDocShell::InternalLoad(nsDocShellLoadState*, nsIDocShell**, nsIRequest**) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:8741:12
    #8 0x7f9d01cdca0d in nsDocShell::LoadURI(nsDocShellLoadState*, bool) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:807:10
    #9 0x7f9d01ca31b4 in mozilla::dom::BrowsingContext::LoadURI(nsDocShellLoadState*, bool) /builds/worker/checkouts/gecko/docshell/base/BrowsingContext.cpp:1429:23
    #10 0x7f9cf9c20397 in mozilla::dom::LocationBase::SetURI(nsIURI*, nsIPrincipal&, mozilla::ErrorResult&, bool) /builds/worker/checkouts/gecko/dom/base/LocationBase.cpp:144:21
    #11 0x7f9cf9c1fd9a in mozilla::dom::Location::SetHash(nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/Location.cpp:173:3
    #12 0x7f9cfa463b58 in mozilla::dom::Location_Binding::set_hash(JSContext*, JS::Handle<JSObject*>, void*, JSJitSetterCallArgs) /builds/worker/workspace/obj-build/dom/bindings/LocationBinding.cpp:912:24
    #13 0x7f9cfc07e9cf in bool mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::MaybeCrossOriginObjectThisPolicy>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3151:8
    #14 0x7f9d02b9f857 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:493:13
    #15 0x7f9d02b9f857 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:585:12
    #16 0x7f9d02ba5274 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:648:10
    #17 0x7f9d02ba5274 in Call /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:665:8
    #18 0x7f9d02ba5274 in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:803:10
    #19 0x7f9d02ddd398 in js::SetPropertyIgnoringNamedGetter(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyDescriptor>, JS::ObjectOpResult&) /builds/worker/checkouts/gecko/js/src/proxy/BaseProxyHandler.cpp:227:8
    #20 0x7f9cfc0a8de1 in mozilla::dom::DOMProxyHandler::set(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) const /builds/worker/checkouts/gecko/dom/bindings/DOMJSProxyHandler.cpp:243:10
    #21 0x7f9cfa3ce7f0 in mozilla::dom::Location_Binding::DOMProxyHandler::set(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) const /builds/worker/workspace/obj-build/dom/bindings/LocationBinding.cpp:1752:32
    #22 0x7f9d02dfcefb in setInternal /builds/worker/checkouts/gecko/js/src/proxy/Proxy.cpp:382:19
    #23 0x7f9d02dfcefb in js::Proxy::set(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /builds/worker/checkouts/gecko/js/src/proxy/Proxy.cpp:390:10
    #24 0x7f9d02b81961 in SetProperty /builds/worker/checkouts/gecko/js/src/vm/ObjectOperations-inl.h:280:12
    #25 0x7f9d02b81961 in SetPropertyOperation /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:277:10
    #26 0x7f9d02b81961 in Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3080:12

SUMMARY: AddressSanitizer: heap-buffer-overflow /builds/worker/workspace/obj-build/dist/include/mozilla/ipc/ProtocolUtils.h:229:31 in Id
Shadow bytes around the buggy address:
  0x0c1c80064150: fd fd fd fd fa fa fa fa fa fa fa fa 00 00 00 00
  0x0c1c80064160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c80064170: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c1c80064180: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
  0x0c1c80064190: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c1c800641a0: fd fd fd fd fd fd fd fd fa fa fa[fa]fa fa fa fa
  0x0c1c800641b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c800641c0: 00 00 00 00 fa fa fa fa fa fa fa fa 00 00 00 00
  0x0c1c800641d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1c800641e0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c1c800641f0: 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==671384==ABORTING
```