2074390 - IndexedDB: using resizable ArrayBuffer as a key crashes the content process

Status: RESOLVED FIXED

(Core :: Storage: IndexedDB, defect)

Description

[Arnaud Bienner]

Attachment: idb-resizable-key-crash.html

Using resizable ArrayBuffer (i.e. defined with maxByteLength argument) as keys results in a crash because of a MOZ_RELEASE_ASSERT, triggered from here.
key = new ArrayBuffer(8, { maxByteLength: 16 });
Same for views:
key = new Uint8Array(new ArrayBuffer(8, { maxByteLength: 16 }));

See attached example.

Loading it in Firefox results in a tab crash, with both a plain array buffer and a view (triggered when passing ?variant=view URL parameter).

On Safari, it works.
On Chrome, it throws a TypeError.

I don't see anything in the spec that forbids it, so we should either support it eventually, or raise a spec issue.

As a first step, since it doesn't work for us, and doesn't work on Chrome either, it's probably OK to just throw an error.

Comment 1

[Arnaud Bienner]

While this is a crash, I'm not sure this is really a security bug, since it crashes on assert, but in doubt, I preferred to mark it as such.

Comment 2

[Arnaud Bienner]

Attachment: Bug 2074390 - IndexedDB: reject resizable array buffers (or view on such buffers) used as keys. r?#dom-storage

Comment 3

[BugBot [:suhaib / :marco]]

:abienner, please review the release status flags for beta, release, and ESR and update each one as appropriate.

For each version, indicate whether it is affected, unaffected, disabled, or wontfix if it is affected but does not need to be fixed on that branch.

Comment 4

[Tyson Smith [:tsmith]]

This rating has been determined by our automated bug rating tool (currently under development). No validation or verification has been performed.

Rating: nosec

Explanation: Not a security bug. Verified in source: a resizable ArrayBuffer (or a view onto one) used as an IndexedDB key reaches Key::EncodeBinary -> ProcessArrayBufferOrView -> ArrayBuffer/ArrayBufferView::ProcessData -> GetCurrentData(), which hits MOZ_RELEASE_ASSERT(!isResizable()) in TypedArray.h:681-683 because the bindings never reject resizable buffers. Impact: the assert fires before getData() is ever called, so the buffer memory is never accessed unsafely; this is a deterministic, controlled abort with no memory corruption. Attack vector: web content calling IDBObjectStore.put() with a resizable ArrayBuffer/view as the key. Reachability: confirmed, runs in the content process and crashes only that tab. A safe crash of a single content process is not a security issue.

Comment 5

[Andrew McCreight [:mccr8]]

This is a release assert, so I think it is okay to unhide.

Comment 6

[Triage Bot (see :simonf)]

Automatic triage (under development): deduplication, sec-rating

This duplicate check has been performed by our automated bug triage tool (currently under development). No validation or verification has been performed.

Bugs considered:

• bug 1806532 — similar symptoms but a different root cause
• bug 2069588 — similar symptoms but a different root cause
• bug 2019806 — similar symptoms but a different root cause

---

This rating has been determined by our automated bug rating tool (currently under development). No validation or verification has been performed.

Comment 8

[Arnaud Bienner]

I've opened a spec issue to follow up on this.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/a23a6b00555d
https://hg.mozilla.org/integration/autoland/rev/d94056a9cb9c
IndexedDB: reject resizable array buffers (or view on such buffers) used as keys. r=dom-storage-reviewers,asuth

Comment 10

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/d94056a9cb9c