Apple CoreGraphics framework logging input data to /tmp

https://www.mozilla.org/en-US/security/advisories/mfsa2014-90/

by rbdn • 12 years ago

138 19 12 years ago

stinos2• 12 years ago

Well every programmer probably made a mistake like that once, twice or more (or just, every programmers makes mistakes tout-court), but imo something like this should have been caught in the pull request/code review/general testing stage as it concerns a major OS? That being said I obviously have no idea what stages precede an actual release of an OS. Anyone does?

richardwhiuk• 12 years ago

More interesting, I think, would be seeing the code change itself, which might make it easier to work out how this got through code review / testing.

ceronman• 12 years ago

The bug is triggered by using a custom memory allocator. It's clearly an edge case. There will be bugs that slip over code review and/or testing no matter what. That's a fact in software development.

stinos2• 12 years ago

Sure, but the thing is: one developper (or a group of) said 'well let's enable this' and then nobody else reviewed that or thought 'hmm, surely it can't be good to just start logging pretty much everything'? Just wondering how that happens in large companies.

didgeoridoo• 12 years ago

Erm...

  goto fail;
  goto fail;

coldcode2• 12 years ago

Very very few OSX apps use an alternate allocator so this was probably not noticed. Having written a commercial memory allocator before (for MacOS prior to OSX) the one in OSX is actually quite good for most people. I don't know why Mozilla decided they needed jemalloc but maybe it tested better for their usage.

Still you would think tracking what's written to such a common directory would have been seen by someone at Apple. Firefox isn't exactly obscure.

acdha2• 12 years ago

jemalloc goes back to Firefox 3:

http://blog.pavlov.net/2007/12/04/vlad-and-analysis-of-dtrac... http://blog.pavlov.net/2008/03/11/firefox-3-memory-usage/

It looks like that was driven by cross-platform concerns – I don't know how good the OS X allocator was in that era but it looks like most of the benchmarking focused on Windows and having a single malloc which performed well on all of their platforms. At that time, Firefox still supported at least as far back as Windows 2000 and the rise of consumer Mac usage hadn't reached current levels.

coldcode2• 12 years ago

The WinHeap allocator before 7 was pretty awful, but apparently improved with 7. Chrome is actually using it (or at least thinking of it). It still amazes me that allocation is still a hard problem 15 years after I wrote mine.

duaneb• 12 years ago

The performance of the memory allocator is very much load-specific on darwin these days, and it would be easy to justify jemalloc. It's certainly not a poor choice of an allocator.

dahjelle2• 12 years ago

I'm using Firefox Developer Edition, and I don't see any CGLog_* files in /tmp at all. Am I missing something?

ZoF• 12 years ago

This issue has been addressed in Mozilla products by explicitly turning off the framework's logging of input events.

It's fixed now and anything you had in there was already auto-deleted at some point. You're likely not missing anything.

dahjelle2• 12 years ago

Awesome—thanks!

jheriko• 12 years ago

another apple 101 screwup.

lets hope that this helps encourage them improve their QA process to the point where they at least test real world applications a bit more heavily (or at all). :)

stevep98• 12 years ago

I didn't see any logs for firefox, but did see a similar file for Google Earth...

"/tmp/CGLog_Google Earth_7790"

full of:

7629.0413465 (Google Earth): CGSGetNextEventRecordInternal: 7629.0410916 loc (90.4, 934.0) conn 0x34b5f MouseMoved win 0x4a0 (click 1) 7629.0581342 (Google Earth): CGSGetNextEventRecordInternal: 7629.0578892 loc (84.4, 929.0) conn 0x34b5f MouseMoved win 0x4a0 (click 1) 7629.0750728 (Google Earth): CGSGetNextEventRecordInternal: 7629.0749128 loc (70.4, 918.0) conn 0x34b5f MouseExited win 0x4a0 tArea 0x19494 7629.0750766 (Google Earth): CGSGetNextEventRecordInternal: 7629.0749338 loc (70.4, 918.0) conn 0x34b5f MouseExited win 0x4a0 tArea 0x19493

Apple CoreGraphics framework logging input data to /tmp

Related Stories