1687243 - Assertion failure: byteLength <= TypedArrayObject::maxByteLength(), at vm/StructuredClone.cpp:2243

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The attached testcase crashes on mozilla-central revision 20210117-8539666101ed (build with --enable-debug --enable-fuzzing --enable-tests, run with FUZZER=StructuredCloneReader ./fuzz-tests test.bin).

Backtrace:

==95==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x563677ce358a bp 0x7ffefaffc5b0 sp 0x7ffefaffc2e0 T0)
==95==The signal is caused by a WRITE memory access.
==95==Hint: address points to the zero page.
SCARINESS: 10 (null-deref)
    #0 0x563677ce358a in JSStructuredCloneReader::readTypedArray(unsigned int, unsigned long, JS::MutableHandle<JS::Value>, bool) js/src/vm/StructuredClone.cpp:2243:3
    #1 0x563677ce4364 in JSStructuredCloneReader::startRead(JS::MutableHandle<JS::Value>, js::gc::InitialHeap) js/src/vm/StructuredClone.cpp:2736:14
    #2 0x563677ccdfab in JSStructuredCloneReader::read(JS::MutableHandle<JS::Value>) js/src/vm/StructuredClone.cpp:3233:8
    #3 0x563677ccd7f8 in ReadStructuredClone(JSContext*, JSStructuredCloneData const&, JS::StructuredCloneScope, JS::MutableHandle<JS::Value>, JS::CloneDataPolicy const&, JSStructuredCloneCallbacks const*, void*) js/src/vm/StructuredClone.cpp:703:12
    #4 0x563677cee02e in JS_ReadStructuredClone(JSContext*, JSStructuredCloneData const&, unsigned int, JS::StructuredCloneScope, JS::MutableHandle<JS::Value>, JS::CloneDataPolicy const&, JSStructuredCloneCallbacks const*, void*) js/src/vm/StructuredClone.cpp:3379:10
    #5 0x563677aa440a in testStructuredCloneReaderFuzz(unsigned char const*, unsigned long) js/src/fuzz-tests/testStructuredCloneReader.cpp:59:8
    [...]

This seems to be a release assert, so there is no immediate danger with respect to the range check. However, since this is in structured clone, I'm marking this s-s anyway until investigated, since there might be other problems at work if we end up in this state and structured clone is a very central/critical component.

Comment 1

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 2

[Jan de Mooij [:jandem]]

Good catch, this is from bug 1686445.

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Bug 1687243 - Fix invalid assertion in readTypedArray. r?sfink!

We can't assume the data is valid, it breaks fuzzing. Also add some tests to ensure
huge 64-bit values are caught early and aren't truncated on 32-bit platforms.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6400d76790f4
Fix invalid assertion in readTypedArray. r=sfink

Comment 5

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/6400d76790f4