Mozilla Foundation Security Advisory 2011-41
Title: Potentially exploitable WebGL crashes
Announced: September 27, 2011
Reporter: Michael Jordan, Ben Hawkes
Products: Firefox, SeaMonkey
Fixed in: Firefox 7.0
Michael Jordon of Context IS reported that in the ANGLE
library used by WebGL the return value from
was not checked for errors. If an attacker could cause requests that
exceeded the available memeory those would fail and potentially lead
to a buffer overrun as subsequent code wrote into the non-allocated space.
Ben Hawkes of the Google Security Team reported a WebGL test case that demonstrated an out of bounds write after an allocation failed.