346794 - RegExp ending in '[\\' reads past end of string

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Daniel Veditz [:dveditz]]

Received at the [e-mail] address:

a friend of mine found a bug in Mozilla's JavaScript RE Engine. We
tracked it down and wrote a reliable example that crashes FF on Linux,
Mac and Windows. All versions including CVS one seem to be affected.
While our findings didn't show any ways of exploiting it, there might be
a way to combine this with other bugs to run arbitrary code.

Ok, now for the details. The deadly code:

<script type="text/javascript">
function boo() {
  s = '';
  for (;;) {
    try {
      new RegExp(s + '[\\');
    } catch(e) {}
    s += 'q';
  }
}
</script>
<a href="javascript:boo()">die die die kill kill kill</a>

The culprit is RE parser, file mozilla/js/src/jsregexp.c, line 1337 (how
appropriate). When '[' is read, the parser loops looking for ']', but if
a '\' is encountered, the pointer is advanced twice. If '\' is the last
character in a regexp, state->cp runs over the string boundaries. Fix:
check if state->cp == state->cpend after incrementing the pointer in
line 1338.

The example code above tries building a large enough string, so that it
gets allocated in the end of heap. Then the parser runs over the end and
runs out of allocated VM, causing a segfault.

As for credits, it was discovered by CanadianGuy, and tracked down by
Girts Folkmanis and Catalin Patulea.

Have a nice day and thanks for making the best browser!  :) 

Cheers,
Girts

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Ick.

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Look before we leap

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 231554 [details] [diff] [review]
Look before we leap

jsregexp.c, sigh.

/be

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into trunk.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into the 1.8 branch.

Comment 6

[Bob Clary [:bc] (inactive)]

Attachment: js1_5/GC/regress-346794.js

Comment 7

[Bob Clary [:bc] (inactive)]

verified fixed 1.8, 1.9 windows/mac(ppc|tel)/linux 20060803

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 231554 [details] [diff] [review]
Look before we leap

approved for 1.8.0 branch, a=dveditz for drivers

Comment 9

[Blake Kaplan (:mrbkap) (inactive)]

Fixed on the 1.8.0 branch.

Comment 10

[Bob Clary [:bc] (inactive)]

note: js1_5/GC/regress-346794.js: result: CRASHED signal  11   type: browser for 1.8.0.7 opt/dbg macppc/linux 20060815, but I have not been able to reproduce.

Comment 11

[Bob Clary [:bc] (inactive)]

verified fixed 1.8.0.7 20060818 windows/mac*/linux

Comment 12

[Bob Clary [:bc] (inactive)]

Checking in js1_5/GC/regress-346794.js;
/cvsroot/mozilla/js/tests/js1_5/GC/regress-346794.js,v  <--  regress-346794.js
initial revision: 1.1
done