Skip to content
Snippets Groups Projects
  1. Feb 28, 2024
    • Gabriele Svelto's avatar
      Bug 1872920 - Change how we notify the main process when we intercept a crash via WER a=diannaS · b695e836
      Gabriele Svelto authored
      This patch makes several fundamental changes to the logic we use to inform
      the main process whenever the WER runtime exception module intercepts a child
      process crash:
      
      * We no longer read the process type or any other data from the child process;
        the process type is passed as the runtime exception module's context
      * We no longer read the address of the memory area used to communicate with the
        main process from the child process arguments. Instead we allocate memory
        directly into the main process and store the required information there
      * We don't read anything from the main process either, the pointer to the
        function used to notify the main process is now found by looking out its
        dedicated section in the parent process' xul.dll mapping
      * We no longer read the OOM crash annotation from a child process, this
        functionality will be restored by making the module use the mozannotation
        crates to fetch all the annotations
      
      Original Revision: https://phabricator.services.mozilla.com/D201589
      
      Differential Revision: https://phabricator.services.mozilla.com/D202916
      b695e836
  2. Sep 11, 2023
  3. Jul 10, 2023
    • Yannis Juglaret's avatar
      Bug 1841751 - Block instances of a malicious injected DLL causing startup... · e193b4be
      Yannis Juglaret authored
      Bug 1841751 - Block instances of a malicious injected DLL causing startup crashes. r=gstoll, a=dmeehan
      
      With bug 1832467 we have updated our Windows SDK version to 10.0.19041.
      As a result, we now have a .retplne section in xul.dll, starting with
      Firefox 115. This is a section with PAGE_NOACCESS protection, so
      accessing it crashes the process.
      
      Some injected DLLs read the whole memory space dedicated to the xul.dll
      image to search for patterns in it. When they hit the .retplne section,
      we will crash. This happened for a legit product in bug 1837242, but
      also for a malicious DLL in bug 1841751. This is a startup crash.
      
      This changeset blocks the variants of this malicious DLL we know, to
      eliminate the associated startup crash spike. Because the DLL does not
      use a fixed name, we block by matching on the combination of version
      number + timestamp + image size, based on the values found in crash
      reports. We additionnally check for a checksum of 0 and the absence of
      debug information, both of which are uncommon for legit production-ready
      DLLs; this thus helps further reduce the chances of collision.
      
      Differential Revision: https://phabricator.services.mozilla.com/D183096
      e193b4be
  4. Jul 08, 2023
  5. Jul 06, 2023
  6. Jun 02, 2023
  7. May 22, 2023
  8. May 16, 2023
  9. May 12, 2023
  10. May 10, 2023
  11. May 09, 2023
  12. May 02, 2023
  13. Apr 27, 2023
  14. Apr 25, 2023
  15. Apr 24, 2023
  16. Apr 20, 2023
  17. Apr 05, 2023
  18. Mar 31, 2023
Loading