369413 - atob("") causes "ASSERTION: index exceeds allowable range" in nsTString.h

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

Steps to reproduce:
  atob(null)
or
  atob("")

Result:
  ###!!! ASSERTION: index exceeds allowable range: 'i <= mLength', file ../../dist/include/string/nsTString.h, line 133

Filing as security-sensitive because it looks like there is no runtime check to prevent reading past the end of the string.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Length checks

This is a stack-allocated buffer, so we're definitely reading within it.  But we're reading random memory.  ;)

Comment 2

[Johnny Stenback (:jst)]

Comment on attachment 254089 [details] [diff] [review]
Length checks

Yeah, should've seen this when I changed this code... r+sr=jst

Comment 3

[Boris Zbarsky [:bzbarsky]]

Fixed.  I should have seen this when I reviewed this code... ;)

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 254089 [details] [diff] [review]
Length checks

Very simple change to length-check a string before looking at its chars.

Comment 5

[Daniel Veditz [:dveditz]]

Comment on attachment 254089 [details] [diff] [review]
Length checks

approved for 1.8/1.8.0 branches, a=dveditz for drivers

Comment 6

[Boris Zbarsky [:bzbarsky]]

Fixed on branches

Comment 7

[Boris Zbarsky [:bzbarsky]]

Attachment: Branch build bustage fix

Comment 8

[Jesse Ruderman]

Crashtest checked in.