1400019 - WebAuthn: Assertion failure: aAlgorithm.IsString()

Status: RESOLVED FIXED

(Core :: DOM: Device Interfaces, defect, P1)

Description

[Christoph Diehl [:posidron]]

Attachment: testcase.html

The following crash occurs consistently on mozilla-central. Last tested revision is 20170914-e217f827cc16

Assertion failure: aAlgorithm.IsString(), at http://searchfox.org/mozilla-central/rev/6326724982c66aaeaf70bb7c7ee170f7a38ca226/dom/webauthn/WebAuthnManager.cpp#59

Could we change this to something other than MOZ_ASSERT? It blocks too much our fuzzing efforts.

Comment 1

[J.C. Jones [:jcj] (he/him)]

Sure, that's no problem. I'll get a patch up shortly.

Comment 2

[J.C. Jones [:jcj] (he/him)]

Attachment: Bug 1400019 - Don't assert on illegal WebAuthn algo names

The algorithm names provided to the WebAuthn methods have to either be a
string, or (potentially) a WebCrypto object. Right now we only work with
strings, but there's no good reason to assert that, we can just let the
action fail.

This patch removes the assert to help out the fuzzing team.

Review commit: https://reviewboard.mozilla.org/r/180098/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/180098/

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8908448 [details]
Bug 1400019 - Don't assert on illegal WebAuthn algo names

https://reviewboard.mozilla.org/r/180098/#review185484

Sounds like a plan.

Comment 4

[J.C. Jones [:jcj] (he/him)]

Ugh, this should have been checked in on Friday.

OK, this patch only affects pref'd off code, and is to enable better fuzzing. Not really sure what the procedure is for post-freeze check-ins...

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a8b326d7a918
Don't assert on illegal WebAuthn algo names r=keeler

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/a8b326d7a918