Post Syndicated from Unknown original https://lcamtuf.blogspot.com/2014/09/cve-2014-1564-uninitialized-memory-when.html
The recent release of Firefox 32 fixes another interesting image parsing issue found by american fuzzy lop: following a refactoring of memory management code, the past few versions of the browser ended up using uninitialized memory for certain types of truncated images, which is easily measurable with a simple <canvas> + toDataURL() harness that examines all the fuzzer-generated test cases.
In general, problems like that may leak secrets across web origins, or more prosaically, may help attackers bypass security measures such as ASLR. For a slightly more detailed discussion, check out this post.
Here’s a short proof-of-concept that should work if you haven’t updated to 32 yet:
This is tracked as CVE-2014-1564, Mozilla bug 1045977. Several more should be coming soon.