308566 - Crash in strict mode on failed octal sequence

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Blake Kaplan (:mrbkap) (inactive)]

Currently, when faced with the attempted octal escape sequence; \260 (and
similar) in strict mode, we refuse to treat it as an octal escape and instead
generate a REOP_BACKREF to the paren match 0xFFFF. This paren doesn't exist, so
we crash attempting to match against it.

I'm marking this security sensitive, since I'm not sure that this isn't
exploitable. This bug is what Bob has been seeing while trying out Igor's
patches in bug 280769, so once this is fixed, we should be able to push those
patches as-is into the tree.

I'm still working on figuring out the most compatible handling of these
"invalid" backrefs.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: imitate IE

This patch seems to imitate what IE does.

Comment 2

[Brendan Eich [:brendan]]

Comment on attachment 196084 [details] [diff] [review]
imitate IE

Righteous.  r+a=me.

/be

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into trunk. I'll check this in on branch tomorrow.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into MOZILLA_1_8_BRANCH.

Comment 5

[Brendan Eich [:brendan]]

*** Bug 308738 has been marked as a duplicate of this bug. ***

Comment 6

[Johnny Stenback (:jst)]

Opening bug per request from mrbkap.

Comment 7

[Bob Clary [:bc] (inactive)]

Checking in regress-308566.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-308566.js,v  <--  regress-308566.js
initial revision: 1.1
done

Comment 8

[Bob Clary [:bc] (inactive)]

no crash firefox 1.5 rc2 winxp/linux

Comment 9

[Daniel Veditz [:dveditz]]

Nominating for old branches because of the linkage to 280769, though they appear to be independent bugs.

Comment 10

[Daniel Veditz [:dveditz]]

Haven't heard that this is required for bug 280769, minusing for old 1.7/aviary101 branches. Crash fix, fixed on trunk and the current 1.8 branch

Comment 11

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 20060818 windows/mac(ppc|tel)/linux