Open
Bug 1900525
Opened 1 month ago
Updated 17 days ago
Assertion failure: inputSizeChecked.isValid(), at mfbt/Compression.cpp:25
Categories
(Core :: JavaScript Engine, defect, P3)
Core
JavaScript Engine
Tracking
()
NEW
| Tracking | Status | |
|---|---|---|
| firefox-esr115 | --- | unaffected |
| firefox126 | --- | wontfix |
| firefox127 | --- | wontfix |
| firefox128 | --- | wontfix |
| firefox129 | --- | fix-optional |
People
(Reporter: nils.bars, Unassigned)
References
(Blocks 2 open bugs, Regression)
Details
(Keywords: regression)
Attachments
(1 file)
|
188 bytes,
text/plain
|
Details |
Steps to reproduce:
Steps to reproduce:
Checkout commit d9496bfef09039b2642da45585ca821c36917c6d and invoke the js shell as follows:
./js-spidermonkey-shell --fast-warmup --fuzzing-safe input_size_checked_01.js
Actual results:
Assertion failure: inputSizeChecked.isValid(), at mfbt/Compression.cpp:25
Group: firefox-core-security → core-security
Component: Untriaged → JavaScript Engine
Product: Firefox → Core
Version: Firefox 125 → Trunk
|
||
Comment 1•1 month ago
|
||
This looks like a problem with the compressLZ4 shell function. We probably need to ensure the size doesn't overflow INT32_MAX. Not security-sensitive if it only affects the shell function.
|
|
||
Updated•1 month ago
|
Status: UNCONFIRMED → NEW
Ever confirmed: true
|
||
Comment 2•1 month ago
|
||
Set release status flags based on info from the regressing bug 1856635
status-firefox126:
--- → affected
status-firefox127:
--- → affected
status-firefox128:
--- → affected
status-firefox-esr115:
--- → unaffected
|
||
Updated•1 month ago
|
Group: core-security → javascript-core-security
|
|
||
Updated•1 month ago
|
|
||
Updated•1 month ago
|
|
||
Updated•1 month ago
|
Attachment #9405436 -
Attachment mime type: application/x-javascript → application/text-plain
|
|
||
Updated•1 month ago
|
Attachment #9405436 -
Attachment mime type: application/text-plain → text/plain
|
||
Comment 3•1 month ago
|
||
This only affects the JS shell and therefore is not a security issue.
Flags: needinfo?(bvisness)
|
|
||
Updated•1 month ago
|
Group: javascript-core-security
|
|
||
Comment 4•27 days ago
|
||
Set release status flags based on info from the regressing bug 1856635
status-firefox129:
--- → affected
|
||
Updated•27 days ago
|
You need to log in
before you can comment on or make changes to this bug.
Description
•