Mozilla

Mozilla

Mozilla Foundation Security Advisory 2011-41

Potentially exploitable WebGL crashes

Announced
September 27, 2011
Reporter
Michael Jordan, Ben Hawkes
Impact
Critical
Products
Firefox, SeaMonkey
Fixed in
  • Firefox 7
  • SeaMonkey 2.4

Description

Michael Jordon of Context IS reported that in the ANGLE library used by WebGL the return value from GrowAtomTable() was not checked for errors. If an attacker could cause requests that exceeded the available memeory those would fail and potentially lead to a buffer overrun as subsequent code wrote into the non-allocated space.

Ben Hawkes of the Google Security Team reported a WebGL test case that demonstrated an out of bounds write after an allocation failed.

References