wasm: Check maximum size of br_table

RESOLVED FIXED in Firefox 54

Status

()

defect
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: bbouvier, Assigned: bbouvier)

Tracking

Trunk
mozilla55
Points:
---
Bug Flags:
qe-verify -

Firefox Tracking Flags

(firefox53 wontfix, firefox54 fixed, firefox55 fixed)

Details

Attachments

(1 attachment)

(Assignee)

Description

2 years ago
This somehow disappeared recently and :decoder found it during fuzzing. Let's fix it.

I need to check whether it should be uplifted as well.
(Assignee)

Updated

2 years ago
Blocks: wasm
Comment hidden (mozreview-request)

Comment 2

2 years ago
mozreview-review
Comment on attachment 8865922 [details]
Bug 1363431: wasm: Check for maximum br_table size;

https://reviewboard.mozilla.org/r/137512/#review141104

Weird; I wonder where it went?
Attachment #8865922 - Flags: review?(luke) → review+

Comment 3

2 years ago
Pushed by bbouvier@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/eb5cc2b22ef0
wasm: Check for maximum br_table size; r=luke
(Assignee)

Comment 4

2 years ago
Comment on attachment 8865922 [details]
Bug 1363431: wasm: Check for maximum br_table size;

Approval Request Comment
[Feature/Bug causing the regression]: wasm (?)
[User impact if declined]: error reporting issue in the best case, browser DOS in the worst case (triggers a very long memory allocation that can exhaust memory, eventually causing a crash)
[Is this code covered by automated tests?]: no
[Has the fix been verified in Nightly?]: yes
[Needs manual test from QE? If yes, steps to reproduce]: no 
[List of other uplifts needed for the feature/fix]: none
[Is the change risky?]: no
[Why is the change risky/not risky?]: more conservative + 2 lines fix
[String changes made/needed]: none
Attachment #8865922 - Flags: approval-mozilla-beta?
Attachment #8865922 - Flags: approval-mozilla-aurora?

Comment 5

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/eb5cc2b22ef0
Status: ASSIGNED → RESOLVED
Last Resolved: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla55
(Assignee)

Comment 6

2 years ago
(forgot to press enter when i set the status flags yesterday -- all versions are affected up to release)
Comment on attachment 8865922 [details]
Bug 1363431: wasm: Check for maximum br_table size;

Fix a wasm issue. Beta54+. Should be in 54 beta 8.
Attachment #8865922 - Flags: approval-mozilla-beta?
Attachment #8865922 - Flags: approval-mozilla-beta+
Attachment #8865922 - Flags: approval-mozilla-aurora?
Attachment #8865922 - Flags: approval-mozilla-aurora-
(In reply to Benjamin Bouvier [:bbouvier] from comment #4)
> [Is this code covered by automated tests?]: no
> [Has the fix been verified in Nightly?]: yes
> [Needs manual test from QE? If yes, steps to reproduce]: no 

Setting qe-verify- based on Benjamin's assessment on manual testing needs.
Flags: qe-verify-
You need to log in before you can comment on or make changes to this bug.