Closed Bug 347804 Opened 18 years ago Closed 18 years ago

Crash [@ FindNextNode] with evil testcase in spell checker code

Categories

(Core :: Spelling checker, defect, P1)

Product:
Core
Component:
Spelling checker
Platform:
x86
Windows XP
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla1.8.1beta2

People

(Reporter: martijn.martijn, Assigned: brettw)

References

Details

(Keywords: crash, testcase, verified1.8.1, Whiteboard: [sg:nse] post ff1.5)

Crash Data

Attachments

(1 file)

Patch
793 bytes, patch
bryner
: review+
dbaron
: approval1.8.1+
Details | Diff | Splinter Review 
See upcoming testcase, which crashes Mozilla when clicking on the button.
You have to download the testcase locally to get the crash, because of the use of enhanced privileges.

The testcase doesn't crash on branch, but the arrow key move code in the testcase works only on trunk, so that doesn't say everything.
The testcase uses a lot of evil code, that's why I want to keep it security sensitive.

Talkback ID: TB21879144E
FindNextNode   FindNextTextNode   mozInlineSpellWordUtil::SetEnd
Attached file testcase — 
I can simplify the testcase further if desired.
Attached patch Patch — — Splinter Review 
I looked for other DOM navigation in this file that did not NULL check the result, and did not find any.
Attachment #232757 - Flags: review?(bryner)
Comment on attachment 232757 [details] [diff] [review]
Patch

This should have no risk and significant benefit.
Attachment #232757 - Flags: approval1.8.1?
Assignee: mscott → brettw
Attachment #232757 - Flags: review?(bryner) → review+
Fixed on trunk.
Priority: -- → P1
Target Milestone: --- → mozilla1.8.1beta2
Blocks: SpellCheckTracking
Comment on attachment 232757 [details] [diff] [review]
Patch

a=dbaron on behalf of drivers.  Please land on MOZILLA_1_8_BRANCH and add the fixed1.8.1 keyword once you have done so.
Attachment #232757 - Flags: approval1.8.1? → approval1.8.1+
Fixed on branch.
Status: NEW → RESOLVED
Closed: 18 years ago
Keywords: fixed1.8.1
Resolution: --- → FIXED
https://bugzilla.mozilla.org/attachment.cgi?id=232610
ff2b2 debug/nightly windows/linux no crash
verified 1.8
Keywords: fixed1.8.1 → verified1.8.1
Whiteboard: [sg:nse] post ff1.5
Group: security
dveditz: should this test remain private?
Crash Signature: [@ FindNextNode]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: