1363431 - wasm: Check maximum size of br_table

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Benjamin Bouvier [:bbouvier] (inactive)]

This somehow disappeared recently and :decoder found it during fuzzing. Let's fix it.

I need to check whether it should be uplifted as well.

Comment 1

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: Bug 1363431: wasm: Check for maximum br_table size;

Review commit: https://reviewboard.mozilla.org/r/137512/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/137512/

Comment 2

[Luke Wagner [:luke]]

Comment on attachment 8865922 [details]
Bug 1363431: wasm: Check for maximum br_table size;

https://reviewboard.mozilla.org/r/137512/#review141104

Weird; I wonder where it went?

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/eb5cc2b22ef0
wasm: Check for maximum br_table size; r=luke

Comment 4

[Benjamin Bouvier [:bbouvier] (inactive)]

Comment on attachment 8865922 [details]
Bug 1363431: wasm: Check for maximum br_table size;

Approval Request Comment
[Feature/Bug causing the regression]: wasm (?)
[User impact if declined]: error reporting issue in the best case, browser DOS in the worst case (triggers a very long memory allocation that can exhaust memory, eventually causing a crash)
[Is this code covered by automated tests?]: no
[Has the fix been verified in Nightly?]: yes
[Needs manual test from QE? If yes, steps to reproduce]: no 
[List of other uplifts needed for the feature/fix]: none
[Is the change risky?]: no
[Why is the change risky/not risky?]: more conservative + 2 lines fix
[String changes made/needed]: none

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/eb5cc2b22ef0

Comment 6

[Benjamin Bouvier [:bbouvier] (inactive)]

(forgot to press enter when i set the status flags yesterday -- all versions are affected up to release)

Comment 7

[Gerry Chang [:gchang]]

Comment on attachment 8865922 [details]
Bug 1363431: wasm: Check for maximum br_table size;

Fix a wasm issue. Beta54+. Should be in 54 beta 8.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/1511c3039be2

Comment 9

[Andrei Vaida [:avaida]]

(In reply to Benjamin Bouvier [:bbouvier] from comment #4)
> [Is this code covered by automated tests?]: no
> [Has the fix been verified in Nightly?]: yes
> [Needs manual test from QE? If yes, steps to reproduce]: no 

Setting qe-verify- based on Benjamin's assessment on manual testing needs.