2031365 - Prevent implicit conversion of js_pod_arena_malloc size_t argument

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Arnaud Bienner]

Follow up of bug 2028731.

This is not a security bug per say, but a follow up to limit the risk of having similar bugs in the future.

Since it might expose information about the original bug (bug 2028731), it should be considered as a security bug until bug 2028731 has been released.

Comment 1

[Arnaud Bienner]

Attachment: (secure)

Comment 2

[BugBot [:suhaib / :marco]]

There is an r+ patch which didn't land and no activity in this bug for 2 weeks.
:abienner, could you have a look please?
If you still have some work to do, you can add an action "Plan Changes" in Phabricator.
For more information, please visit BugBot documentation.

Comment 3

[Arnaud Bienner]

It's expected: it's a follow up (test) for a sec-high which has been landed recently (bug 2028731). I'm waiting for the original fix to have been live for 4 weeks before landing that one, as requested by our procedure for security bug.
"Tests should only be checked in later, after an official Firefox release that contains the fix has been live for at least four weeks."

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/d03d9d86efc5
https://hg.mozilla.org/integration/autoland/rev/8e0d2cdf22f8
Prevent implicit conversion of size_t arguments when calling js_pod alloc functions r=baku,spidermonkey-reviewers,sfink

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg-edge.mozilla.org/mozilla-central/rev/8e0d2cdf22f8