1849037 - (CVE-2023-6866) Many uses of TypedArray::Create don't handle failures correctly

Status: RESOLVED FIXED

(Core :: DOM: Bindings (WebIDL), defect)

Description

[Tom S. (please needinfo tschuster)]

Looking at the uses of TypedArray::Create it seems to me like many either don't really consider this API fallible at all or don't clear the pending exception properly.

Considering how many problematic uses there are, even in some abstractions like CryptoBuffer::ToArrayBuffer, we should consider changing this API. I imagine we could change it to have an ErrorResult parameter by stealing the exception internally?

Comment 1

[Daniel Veditz [:dveditz]]

Without a specific PoC it's hard to call this sec-high, but boy does this smell like trouble brewing. In the cryptobuffer case the webauthn buffers are small enough that if you're that close to OOM there's likely lots of other failing things. But I bet there are other features with more user-defined data could be easier to trigger.

Comment 2

[Andreas Farre [:farre]]

Peter, is this something that your TypedArray patches will fix?

Comment 3

[Peter Van der Beken [:peterv]]

No, but it was next on my things I want to look at for TypedArray.

Comment 4

[Andreas Farre [:farre]]

Peter, feel free to change if you think severity should be higher.

Comment 5

[Peter Van der Beken [:peterv]]

Attachment: Bug 1849037 - Pass objects that support conversion to a Span directly to TypedArray::Create as a Span. r?farre!

Comment 6

[Peter Van der Beken [:peterv]]

Attachment: Bug 1849037 - Make TypedArray::Create either take a length or a Span. r?farre!

Depends on D191416

Comment 7

[Peter Van der Beken [:peterv]]

Attachment: Bug 1849037 - Add ErrorResult to TypedArray::Create. r?farre!

Depends on D191417

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c336a8c78928
Pass objects that support conversion to a Span directly to TypedArray::Create as a Span. r=necko-reviewers,extension-reviewers,media-playback-reviewers,profiler-reviewers,farre,padenot,jesup
https://hg.mozilla.org/integration/autoland/rev/89aa49de2473
Make TypedArray::Create either take a length or a Span. r=farre
https://hg.mozilla.org/integration/autoland/rev/27fd9f6f57ea
Add ErrorResult to TypedArray::Create. r=necko-reviewers,extension-reviewers,media-playback-reviewers,webidl,profiler-reviewers,farre,padenot,smaug,robwu,jesup

Comment 9

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/995799598f27
Backed out 3 changesets for causing mochitests failures in test_gamepad_extensions.html.

Comment 10

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Push with mochitest failures
Failure log

TEST-UNEXPECTED-FAIL | dom/tests/mochitest/gamepad/test_gamepad_extensions.html | correct touch surfaceDimensions - got false, expected true
TEST-UNEXPECTED-FAIL | dom/tests/mochitest/gamepad/test_gamepad_multitouch_crossorigin.html | correct touch surfaceDimensions - got false, expected true

Push with hazard failure
Failure log

TEST-UNEXPECTED-FAIL | hazards | unrooted 'array' of type 'JS::TypedArray<JS::Scalar::Uint8>' live across GC call at dist/include/mozilla/dom/TypedArray.h:742

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/695789b9b326
Pass objects that support conversion to a Span directly to TypedArray::Create as a Span. r=necko-reviewers,extension-reviewers,media-playback-reviewers,profiler-reviewers,farre,padenot,jesup
https://hg.mozilla.org/integration/autoland/rev/4efe82747dc2
Make TypedArray::Create either take a length or a Span. r=farre
https://hg.mozilla.org/integration/autoland/rev/29fb30143955
Add ErrorResult to TypedArray::Create. r=necko-reviewers,extension-reviewers,media-playback-reviewers,webidl,profiler-reviewers,farre,padenot,smaug,robwu,jesup,aabh

Comment 12

[Dianna Smith [:diannaS]]

https://hg.mozilla.org/mozilla-central/rev/695789b9b326
https://hg.mozilla.org/mozilla-central/rev/4efe82747dc2
https://hg.mozilla.org/mozilla-central/rev/29fb30143955

Comment 13

[Jason Kratzer [:jkratzer]]

Attachment: advisory.txt

Comment 14

[Daniel Veditz [:dveditz]]

Bulk-unhiding security bugs fixed in Firefox 119-121 (Fall 2023). Use "moo-doctrine-subsidy" to filter

Comment 15

[Daniel Veditz [:dveditz]]

Sorry for the burst of bugspam: filter on tinkling-glitter-filtrate
Adding reporter-external keyword to security bugs found by non-employees for accounting reasons