1900525 - Assertion failure: inputSizeChecked.isValid(), at mfbt/Compression.cpp:25

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Nils Bars]

Attachment: input_size_checked_01.js

Steps to reproduce:

Steps to reproduce:

Checkout commit d9496bfef09039b2642da45585ca821c36917c6d and invoke the js shell as follows:

./js-spidermonkey-shell --fast-warmup --fuzzing-safe input_size_checked_01.js

Actual results:

Assertion failure: inputSizeChecked.isValid(), at mfbt/Compression.cpp:25

Comment 1

[Jan de Mooij [:jandem]]

This looks like a problem with the compressLZ4 shell function. We probably need to ensure the size doesn't overflow INT32_MAX. Not security-sensitive if it only affects the shell function.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1856635

Comment 3

[Ben Visness [:bvisness]]

This only affects the JS shell and therefore is not a security issue.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1856635

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: debug stack

compressLZ4(new ArrayBuffer(2**31));

$ ~/shell-cache/js-dbg-64-linux-x86_64-c0927f7f515e-582651/js-dbg-64-linux-x86_64-c0927f7f515e-582651 --fuzzing-safe --no-threads --no-baseline --no-ion testcase.js
[297253] Assertion failure: inputSizeChecked.isValid(), at /home/msf2/trees/firefox/mozglue/static/Compression.cpp:25

Tested with gh rev c0927f7f515e.

(gdb) bt
#0  0x00005555589ce57f in MOZ_CrashSequence (aAddress=0x0, aLine=25) at /home/msf2/shell-cache/js-dbg-64-linux-x86_64-c0927f7f515e-582651/objdir-js/dist/include/mozilla/Assertions.h:248
#1  mozilla::Compression::LZ4::compress (aSource=<optimized out>, aInputSize=<optimized out>, aDest=<optimized out>) at /home/msf2/trees/firefox/mozglue/static/Compression.cpp:25
#2  0x00005555571d90f1 in CompressLZ4 (cx=cx@entry=0x7ffff5e3c200, argc=<optimized out>, vp=<optimized out>) at /home/msf2/trees/firefox/js/src/shell/js.cpp:9368
#3  0x00005555572f1be5 in CallJSNative (cx=cx@entry=0x7ffff5e3c200, native=0x5555571d8de0 <CompressLZ4(JSContext*, unsigned int, JS::Value*)>, reason=<optimized out>, args=...)
    at /home/msf2/trees/firefox/js/src/vm/Interpreter.cpp:501
#4  0x00005555572cdfa6 in js::InternalCallOrConstruct (cx=0x7ffff5e3c200, args=..., construct=construct@entry=js::NO_CONSTRUCT, reason=js::CallReason::Call)
    at /home/msf2/trees/firefox/js/src/vm/Interpreter.cpp:597
#5  0x00005555572ced08 in InternalCall (cx=<optimized out>, args=..., reason=25) at /home/msf2/trees/firefox/js/src/vm/Interpreter.cpp:664
/snip

Jan, this is an updated testcase. With the simplicity, it's really easy to trigger. If it is not a priority, can we please get at least a patch or ignore it under --fuzzing-safe for now?

Comment 7

[Andrew McCreight [:mccr8]]

Attachment: Bug 1900525 - Make the LZ4 shell functions fuzzing unsafe.

compressLZ4 has some unfixed overflow integer issues that at least 3
different fuzzing people have stumbled over. Given that this was first reported
more than a year ago without being fixed, let's at least keep fuzzing people
from hitting this.

Comment 8

[Andrew McCreight [:mccr8]]

I tested load-mod.js and compression.js in a shell build and they still seem to pass.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/2f6e97224b7a
https://hg.mozilla.org/integration/autoland/rev/76e7a3b5c9ad
Make the LZ4 shell functions fuzzing unsafe. r=rhunt

Comment 10

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/76e7a3b5c9ad