311629 - stack overflow (in UnaryExpr? )

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[:Mook]

Tested to occur on:
1.0.7 (Win32, release);
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051007
Firefox/1.6a1

Steps to reproduce:
1. perl -e 'print "+ " x 60000 ;' > test.txt
  1a. Somehow get a string of "+ " repeated 60 000 times otherwise :)
2. copy the contents of test.txt into the JS console and click on Evaluate
3. crash

Expected Results
Error in JS console, and not crash.

Actual Results.
Crash

Discussion:
This is remotely exploitable (crash also happens in <script> tags on content
pages).  Dataloss, I guess.

First few lines of talkback: (TB10376057Q, TB10376528Q, TB10376612X)
GetChar  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsscan.c,
line 362]
js_GetToken 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsscan.c, line 1294]
UnaryExpr 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsparse.c, line 2764]
UnaryExpr 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsparse.c, line 2764]
UnaryExpr 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsparse.c, line 2764]
UnaryExpr 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsparse.c, line 2764]
... etc.  Same stack (different line numbers - 303/774/2592) for 1.0.7

(Thanks to Tonglebeak and ispiked on #firefox for the help)

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Add a needed check

On IRC, #content,
[   brendan]: so r=me on the CHECK_RECURSION

Comment 2

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/Regress/regress-311629.js,v  <--  regress-311629.js
initial revision: 1.1

Comment 3

[Brendan Eich [:brendan]]

Ideally safe fix for 1.8rc1.  This should go on the trunk ASAP.  Thanks,

/be

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into trunk.

Comment 5

[Daniel Veditz [:dveditz]]

Should this go on the 1.7/aviary branches as well?

Comment 6

[Brendan Eich [:brendan]]

(In reply to comment #5)
> Should this go on the 1.7/aviary branches as well?

Can't hurt, but it's not needed for security against remote exploit, or for XSS
or privacy protection -- just for DOS prevention.

/be

Comment 7

[Scott MacGregor]

Blake, can you get this checked into the branch? Thanks.

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

Checked into MOZILLA_1_8_BRANCH.

Comment 9

[Bob Clary [:bc] (inactive)]

no crash firefox 1.5 rc2 winxp/linux

Comment 10

[Bob Clary [:bc] (inactive)]

verified fixed 1.8.x and trunk.