1019892 - propFlags is uninitialized in jsd_GetValueProperty if JS_GetPropertyById returns null

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Andrew McCreight [:mccr8]]

I don't know how bad this is.

Comment 1

[Andrew McCreight [:mccr8]]

How bad is this?  Setting a property with random garbage flags sounds bad...

Comment 2

[Andrew McCreight [:mccr8]]

This is using the old JS debugger interface, and I think it only happens on a particular OOM, so it doesn't seem too dangerous.

Comment 3

[Steve Fink [:sfink] [:s:]]

Uh, am I reading this wrong? The way I read it, propFlags is uninitialized in the *success* case. Which would be much worse, of course. The logic I see is

  if (!JS_GetPropertyById()) {
    propFlags = JSPD_EXCEPTION or JSPD_ERROR;
    propValue = JSVAL_VOID or uninitialized;
  } else {
    propFlags = uninitialized;
    propValue = value;
  }
  propFlags |= some stuff;
  return _newProperty(...propValue, propFlags...);

Oh. Except this is all pretty innocuous. We're not creating any properties here. We're just making a JSD reflection of a property. If it has the wrong flags, it'll only make the debugger display the wrong thing or something. I don't know if anyone ever even looks at these flags. (Probably not, if they're usually wrong!)

Comment 4

[Andrew McCreight [:mccr8]]

Ah, ok.  It sounds like this doesn't need to be a security bug.  Thanks for the analysis!

Comment 5

[Florian Bender]

Has the affected code been removed now with Bug 800200 being fixed, i.e. can this bug be closed?

Comment 6

[Andrew McCreight [:mccr8]]

Sounds good to me.