Bugzilla@Mozilla – Bug 449703
[1.8 branch] XBM appears to draw uninitialized memory
Last modified: 2008-09-23 09:47:39 PDT
Summon comment box
Created attachment 332877 [details] testcase (XBM) Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.16) Gecko/20080702 Firefox/2.0.0.16 Loading this XBM file makes Firefox 2 draw some random pixels. They're different each time the image is reloaded, so it seems like Firefox might be displaying contents of uninitialized memory. In Firefox 3 and trunk, I just see white, but I don't know whether the bug was really fixed (or whether it was fixed intentionally). Billy Hoffman pointed this bug out during his talk at Black Hat today.
Vlad, can you find an owner for this?
It would be nice to plug this in the next FF2 update since it's public. probably a memset() is all it needs.
Presumably this was fixed on trunk by bug 376471?
Created attachment 334923 [details] [review] potential fix? I can't actually get 1.8.1 to build on my mac any more; this bug is OSX-only, right? This is likely to fix it if so; if someone has a 1.8.1 build they could try this out on, that'd be helpful.
Comment on attachment 334923 [details] [review] potential fix? Dan, can you test this patch?
Well, yes, I can test the mac-only patch, but this is not a mac-only bug.
Ah, I didn't realize it wasn't Mac-only -- I can test 1.8.1 on linux.
The patch didn't seem to work on the Mac. Did I not clobber enough?
Created attachment 335439 [details] [review] fix Looks like this buffer isn't being zero'd out if we happen to bail early. Do so.
Comment on attachment 335439 [details] [review] fix Tested on Mac and Windows, r=dveditz Approved for 1.8.1.17, a=dveditz for release-drivers.
Checking in nsXBMDecoder.cpp; /cvsroot/mozilla/modules/libpr0n/decoders/xbm/nsXBMDecoder.cpp,v <-- nsXBMDecoder.cpp new revision: 1.17.2.2; previous revision: 1.17.2.1 done This doesn't seem to be present on trunk (and indeed, the offending code is gone from trunk -- memory allocation happens in a different spot).
Verified for 1.8.1.17 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.17) Gecko/2008082910 Firefox/2.0.0.17.
Comment on attachment 335439 [details] [review] fix a=asac for 1.8.0.15