1919707 - Off-by-one errors in src/shell/js.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Julian Seward [:jseward]]

Running the shell with MOZ_LOG=wasmCodeMetaStats:3 (as introduced by bug
1911071) produces valgrind output

Invalid read of size 1
   at 0x4C3B7B7: strstr (vg_replace_strmem.c:1814)
   by 0x212497B: ParseLoggerOptions() (src/shell/js.cpp:428)
   by 0x2127AFC: main (src/shell/js.cpp:12115)
 Address 0x51fd176 is 0 bytes after a block of size 22 alloc'd
   at 0x4C34EC8: calloc (vg_replace_malloc.c:1675)
   by 0x2124910: ParseLoggerOptions() (src/shell/js.cpp:425)
   by 0x2127AFC: main (src/shell/js.cpp:12115)

Invalid read of size 1
   at 0x4C3B7D0: strstr (vg_replace_strmem.c:1814)
   by 0x212497B: ParseLoggerOptions() (src/shell/js.cpp:428)
   by 0x2127AFC: main (src/shell/js.cpp:12115)
 Address 0x51fd113 is 0 bytes after a block of size 19 alloc'd
   at 0x4C34EC8: calloc (vg_replace_malloc.c:1675)
   by 0x2124809: ParseLoggerOptions() (src/shell/js.cpp:412)
   by 0x2127AFC: main (src/shell/js.cpp:12115)

Invalid read of size 1
   at 0x5019593: ____strtol_l_internal (strtol_l.c:449)
   by 0x500CDE3: atoi (atoi.c:27)
   by 0x21249DE: ParseLoggerOptions() (src/shell/js.cpp:436)
   by 0x2127AFC: main (src/shell/js.cpp:12115)
 Address 0x51fd113 is 0 bytes after a block of size 19 alloc'd
   at 0x4C34EC8: calloc (vg_replace_malloc.c:1675)
   by 0x2124809: ParseLoggerOptions() (src/shell/js.cpp:412)
   by 0x2127AFC: main (src/shell/js.cpp:12115)

There are two callocs where the allocated size is strlen(c-style-string)
and I think it needs to be strlen(..) + 1.

This is hardly a sec-bug .. please declassify as appropriate.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1904429

:mgaudet, since you are the author of the regressor, bug 1904429, could you take a look?

For more information, please visit BugBot documentation.

Comment 2

[Julian Seward [:jseward]]

Attachment: Bug 1919707 - Off-by-one errors in src/shell/js.cpp. r=mgaudet.

This patch fixes a couple of off-by-one errors in the parsing of
MOZ_LOG strings in the JS shell.

Comment 3

[Matthew Gaudet (he/him) [:mgaudet]]

This is not a sec bug (shell only, requires environment variable)... trying to declassify and failing tho.

Comment 4

[Matthew Gaudet (he/him) [:mgaudet]]

Thanks Ryan!

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2a3a646662b6
Off-by-one errors in src/shell/js.cpp.  r=mgaudet.

Comment 6

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/2a3a646662b6