554504 - Possible crash in AvmCore::throwErrorV() in non-debugger builds

Status: RESOLVED FIXED

(Tamarin Graveyard :: Virtual Machine, defect, P2)

Description

[William Maddox]

The code below will dereference NULL in a non-debugger build should type == NULL.  This is presumably an erroneous condition, but one that is allowed for.  We should at least cleanly terminate.

This issue was detected by static analysis and does not reflect an actual observed failure.

    void AvmCore::throwErrorV(ClassClosure *type, int errorID, Stringp arg1, Stringp arg2, Stringp arg3)
    {
        Stringp out = formatErrorMessageV( errorID, arg1, arg2, arg3);

        #ifdef DEBUGGER
        if (type == NULL)
        {
            // print the error message, because we're still bootstrapping
            // and the exception type is not yet defined
            console << out << "\n";
        }
        #endif

        Atom args[3] = { nullObjectAtom, out->atom(), intToAtom(errorID) };
        throwAtom(type->construct(2, args));
    }

Comment 1

[Edwin Smith]

even in DEBUGGER, it will dereference a NULL type.  The erroneous condition is only possible when the VM is bootstrapping itself, indicating a bug in the VM itself and not something a working VM could ever experience at runtime.  Ideally the whole #ifdef DEBUGGER block should be turned into an AvmAssertMsg.

Comment 2

[Dan Smith]

Retargeting to 10.2, not a critical issue.

Comment 3

[Lars T Hansen]

Attachment: Patch

Comment 4

[Lars T Hansen]

tamarin-redux changeset:   4384:95d7dd9119aa