1519337 - UTF8CharEnumerator: Off-by-one reads past the end of buffer when buffer ends after bytes that form a valid prefix for a 3-byte or 4-byte UTF-8 sequence

Status: RESOLVED FIXED

(Core :: Internationalization, defect)

Description

[Henri Sivonen (:hsivonen)]

Some bound checks in my rewrite of UTF8CharEnumerator are bogus. By reading the code, it appears that it's possible to read one byte past the end of the input.

(Fortunately, usage patterns suggest low actual security impact.)

Comment 1

[Henri Sivonen (:hsivonen)]

Attachment: Bug 1519337 - Adjust bound checks in UTF8CharEnumerator.

Comment 2

[Ryan VanderMeulen [:RyanVM]]

Given the severity, it sounds like this can just ride the trains whenever it's ready to land.

Comment 3

[Henri Sivonen (:hsivonen)]

Thanks for the r+.

(In reply to Ryan VanderMeulen [:RyanVM] from comment #2)

Given the severity, it sounds like this can just ride the trains whenever it's ready to land.

Landing queued. Furthermore, what the patch does is so obvious that it didn't make sense to try to obscure the test case or the commit message.

For clarity about the severity:

Previously, the code returned correct-appearing results and, therefore, passed the previous tests that tried to test buffer end boundary conditions, because when the end pointer points to a zero terminator, the out-of-bounds read reads an allocated byte and the byte doesn't fit the UTF-8 sequence.

If there isn't a zero terminator, if the memory access doesn't segfault, there is disclosure of at most 7 bits, but in our usage, the bits are disclosed to our internal callers that don't make it practical to disclose the bits further out.

Comment 4

[Henri Sivonen (:hsivonen)]

I filed this as a security bug just in case, but having inspected the callers this doesn't even meet the criteria for "low", i.e. the severity is lower than low, AFAICT. I suggest unhiding.

Comment 5

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/integration/autoland/rev/59696b74a507d82a85b8ca318cc9a100554038a2
https://hg.mozilla.org/mozilla-central/rev/59696b74a507