[tbb-bugs] #19400 [Applications/Tor Browser]: [Asan] Crash in js::AsmJSModule::deserialize / DeserializeSig

[Tor Bug Tracker & Wiki]

#19400: [Asan] Crash in js::AsmJSModule::deserialize / DeserializeSig
-------------------------------------------------+-------------------------
 Reporter:  cypherpunks                          |          Owner:  tbb-
     Type:  defect                               |  team
 Priority:  Very High                            |         Status:
Component:  Applications/Tor Browser             |  assigned
 Severity:  Critical                             |      Milestone:
 Keywords:  tbb-crash, TorBrowserTeam201606,     |        Version:
  tbb-6.0-issues                                 |     Resolution:
Parent ID:                                       |  Actual Points:
 Reviewer:                                       |         Points:
                                                 |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by cypherpunks):

 Following these steps I get a different crasher:
 1. Installing a vanilla 6.0a5-hardened
 2. visiting facebook
 3. update to 6.5a1-hardened
 4. visit facebook again, type in different comment fields

 I get this now (not immediately though):

 {{{
 1465932200900   addons.productaddons    ERROR   Request failed certificate
 checks: [Exception... "SSL is required and URI scheme is not https."
 nsresult: "0x8000ffff (NS_ERROR_UNEXPECTED)"  location: "JS frame ::
 resource://gre/modules/CertUtils.jsm :: checkCert :: line 145"  data: no]
 =================================================================
 ==23172==ERROR: AddressSanitizer: stack-buffer-underflow on address
 0x7f2e552749a0 at pc 0x7f2ea6de6605 bp 0x7f2e585a53f0 sp 0x7f2e585a4ba0
 READ of size 9437184 at 0x7f2e552749a0 thread T61 (DOM Worker)
 ASAN:SIGSEGV
 ==23172==AddressSanitizer: while reporting a bug found another one.
 Ignoring.
 }}}

 5. removing the
 `profile.default/storage/temporary/https+++www.facebookcorewwwi.onion/`
 6. browse facebookcorewwwi.onion again, type some comments, etc: Crasher
 is gone.

 I'll post a backtrace once I can (may take a day)

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/19400#comment:23>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online