Bug 570089

Scary, this bug affected me today. I can reproduce this bug with the URL specified. This obviously has security implications, and seems like it could be a remote root vulnerability.

(gdb) bt
#0  0x00839410 in __kernel_vsyscall ()
#1  0x00c1fdf0 in raise () from /lib/libc.so.6
#2  0x00c21701 in abort () from /lib/libc.so.6
#3  0x080a2e85 in ddxGiveUp () at xf86Init.c:1261
#4  0x081bbe93 in AbortServer () at log.c:408
#5  0x081bc426 in FatalError (f=0x81cd800 "Caught signal %d.  Server aborting\n") at log.c:554
#6  0x080d1c20 in xf86SigHandler (signo=11) at xf86Events.c:1484
#7  <signal handler called>
#8  fbCompositeSrc_8888x8888mmx (op=3 '\003', pSrc=0x8e76278, pMask=0x0, pDst=0x8e3ec40, xSrc=0, ySrc=2607, xMask=0, yMask=0, xDst=710, yDst=2420, width=500, 
    height=52057) at fbmmx.c:1312
#9  0x001874fb in fbComposite (op=3 '\003', pSrc=0x8e76278, pMask=0x0, pDst=0x8e3ec40, xSrc=0, ySrc=1767, xMask=0, yMask=0, xDst=710, yDst=0, width=500, 
    height=1016) at fbpict.c:1299
#10 0x0032ceeb in XAAComposite (op=3 '\003', pSrc=0x8e76278, pMask=0x0, pDst=0x8e3ec40, xSrc=0, ySrc=-153, xMask=0, yMask=0, xDst=710, yDst=0, width=500, 
    height=1016) at xaaPict.c:536
#11 0x005285f8 in i830_xaa_composite (op=3 '\003', pSrc=0x8e76278, pMask=0x0, pDst=0x8e3ec40, xSrc=0, ySrc=-153, xMask=0, yMask=0, xDst=710, yDst=0, 
    width=500, height=1016) at i830_xaa.c:873
#12 0x0816aa46 in cwComposite (op=3 '\003', pSrcPicture=0x8e76278, pMskPicture=0x0, pDstPicture=0x8e3ec40, xSrc=0, ySrc=-153, xMsk=0, yMsk=0, xDst=710, 
    yDst=0, width=500, height=1016) at cw_render.c:275
#13 0x081673b6 in damageComposite (op=3 '\003', pSrc=0x8e76278, pMask=0x0, pDst=0x8e3ec40, xSrc=0, ySrc=-153, xMask=0, yMask=0, xDst=710, yDst=0, width=500, 
    height=1016) at damage.c:541
#14 0x08154503 in CompositePicture (op=3 '\003', pSrc=0x8e76278, pMask=0x0, pDst=0x8e3ec40, xSrc=0, ySrc=-153, xMask=0, yMask=0, xDst=710, yDst=0, width=500, 
    height=1016) at picture.c:1789
#15 0x0815a34f in ProcRenderComposite (client=0x8e05e18) at render.c:758
#16 0x081576c5 in ProcRenderDispatch (client=0x1e00) at render.c:2005
#17 0x080894fa in Dispatch () at dispatch.c:459
#18 0x08070755 in main (argc=10, argv=0xbf9ad824, envp=Cannot access memory at address 0x1e08
) at main.c:447
(gdb) frame 8
#8  fbCompositeSrc_8888x8888mmx (op=3 '\003', pSrc=0x8e76278, pMask=0x0, pDst=0x8e3ec40, xSrc=0, ySrc=2607, xMask=0, yMask=0, xDst=710, yDst=2420, width=500, 
    height=52057) at fbmmx.c:1312
1312                __m64 vs = *(__m64 *)(src + 0);
(gdb) x/i $pc
0x197273 <fbCompositeSrc_8888x8888mmx+451>:     movq   (%eax),%mm4
(gdb) p/x $eax
$1 = 0xaf169000

(Question: is ySrc=-153 in frame14 expected?)

Temporary workaround (at the expense of losing xrender):

Section "Extensions"
    Option "RENDER" "disable"
EndSection

in /etc/X11/xorg.conf.

00:02.0 VGA compatible controller: Intel Corporation Mobile 4 Series Chipset Integrated Graphics Controller (rev 07)
00:02.1 Display controller: Intel Corporation Mobile 4 Series Chipset Integrated Graphics Controller (rev 07)

$ rpm -qf /usr/lib/xorg/modules/drivers/intel_drv.so
xorg-x11-drv-i810-1.6.5-9.25.el5

Tavis, thanks for the heads-up.

Similar report - bug #498500.

bug #495733 looks also similar

The fix proposed in https://bugzilla.redhat.com/show_bug.cgi?id=495733#c15 (ie attachment https://bugzilla.redhat.com/attachment.cgi?id=403292) should fix this bug as well (at least it does in my tests).

Patch works here as well Olivier, Thanks.

That must have been tough to spot, very cool.

*** This bug has been marked as a duplicate of bug 495733 ***