1900525 - Assertion failure: inputSizeChecked.isValid(), at mfbt/Compression.cpp:25

Status: NEW

(Core :: JavaScript Engine, defect, P3)

Description

[Nils Bars]

Attachment: input_size_checked_01.js

Steps to reproduce:

Steps to reproduce:

Checkout commit d9496bfef09039b2642da45585ca821c36917c6d and invoke the js shell as follows:

./js-spidermonkey-shell --fast-warmup --fuzzing-safe input_size_checked_01.js

Actual results:

Assertion failure: inputSizeChecked.isValid(), at mfbt/Compression.cpp:25

Comment 1

[Jan de Mooij [:jandem]]

This looks like a problem with the compressLZ4 shell function. We probably need to ensure the size doesn't overflow INT32_MAX. Not security-sensitive if it only affects the shell function.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1856635

Comment 3

[Ben Visness [:bvisness]]

This only affects the JS shell and therefore is not a security issue.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1856635