1489020 - Use after free in IndexedDB

Status: RESOLVED FIXED

(Core :: Storage: IndexedDB, defect, P1)

Description

[zhanjiasong45]

Attachment: FireFox_IndexedDB_UAF2.html

The patch for Bug 1459383 is not good enough, it can be bypassed by setting the getter on Object's prototype.

Steps to reproduce:
run firefox with attached html

Firefox version:62.0 (64-bit)
operating system version:Linux x86_64

Comment 1

[zhanjiasong45]

Attachment: asan log info

asan log from latest asan version(download from https://developer.mozilla.org/en-US/docs/Mozilla/Testing/Firefox_and_Address_Sanitizer ,64.0a1 (2018-09-06) (64-bit) ).

Comment 2

[Andrew Sutherland [:asuth] (he/him)]

Thank you for the repro!  It is invaluable!

Over in bug 1487660 where ASAN caught this (presumably due to your testing of your prototype and reporting of the crash, which we appreciate!)  I was hypothesizing that the problem was a prototype chain issue since we perform the clone in the same realm/global, so it's good to have a conclusive answer and repro here!  (It's bad that I didn't think of the problem during the original fix of course!)

Comment 5

[Marion Daly [:mdaly]]

Jan, all yours.

Comment 6

[Jan Varga [:janv]]

This is the same issue as in bug 1487660, not sure if we should dupe it since there's a sec-bounty? flag.

Comment 7

[Christian Holler (:decoder)]

(In reply to Jan Varga [:janv] from comment #6)
> This is the same issue as in bug 1487660, not sure if we should dupe it
> since there's a sec-bounty? flag.

The reporter of bug 1487660 and this bug are the same, we can dupe the other bug to this one and handle the sec-bounty flag here.

Comment 8

[Jan Varga [:janv]]

This has been fixed. See bug 1487660 and bug 1492737.