305335 - E4X: possibly exploitable crash in XML instance methods

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[shutdown]

XML instance methods use JS_GetPrivate() without any type checking.
Especially, xml_parent() may allow one to create
false JSObject with malicious JSObjectMap.
This is similar to bug 290162 and bug 295854.

javascript: o=new Number(0); o.__proto__=XML(); o.parent();
TB8553505H

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b4) Gecko/20050820 Firefox/1.0+

Comment 1

[Jesse Ruderman]

Brendan, can you look at this?

Comment 2

[Brendan Eich [:brendan]]

The non-standard way E4X hides methods in the prototype, making them not be
[[Get]]able, was supposed to save us here.  More soon.

/be

Comment 3

[Brendan Eich [:brendan]]

Attachment: fix

I didn't see a chokepoint way of doing this.

/be

Comment 4

[Mike Shaver (:shaver emeritus)]

Comment on attachment 193491 [details] [diff] [review]
fix

sr=shaver

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 193491 [details] [diff] [review]
fix

r=mrbkap

Comment 6

[Brendan Eich [:brendan]]

Fixed on trunk and branch.

/be

Comment 7

[Bob Clary [:bc] (inactive)]

Attachment: e4x/Regress/regress-305335.js

Comment 8

[Bob Clary [:bc] (inactive)]

no crash firefox 1.5 rc2 linux/win32 2005-11-07-12 in shell/browser

Comment 9

[Bob Clary [:bc] (inactive)]

testcase+ to get this off my radar. when this is made public, i will check in the test.

Comment 10

[Bob Clary [:bc] (inactive)]

RCS file: /cvsroot/mozilla/js/tests/e4x/Regress/regress-305335.js,v
done
Checking in regress-305335.js;
/cvsroot/mozilla/js/tests/e4x/Regress/regress-305335.js,v  <--  regress-305335.js
initial revision: 1.1

Comment 11

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 20060818 win/mac*/linux