373931 - javascript integer overflow in memory allocation

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[lsg-mtso]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1.2) Gecko/20070225 BonEcho/2.0.0.2
Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1.2) Gecko/20070225 BonEcho/2.0.0.2

js.c ReadLine() exponentionally allocates it's read buffer.

Reproducible: Always

Steps to Reproduce:
1.
2.
3.
Actual Results:  
The various calculations around the size of the buffer desynchronize during read's.  Bufsize can quickly wrap 0 and be vastly smaller then buflength causing a read past the heap chunk allocated.


Use caution when allocating exponentially, this allocator will fail just after an allocation of 0x40000000 which is likely to be present on many systems.

Comment 1

[Brendan Eich [:brendan]]

js.c is not part of any web browser or mail app, it's just a standalone testing shell. But it is (IIRC) shipped as part of openbsd, in /usr/bin/js. We should definitely fix this -- handing to crowder. Thanks for the report!

Not sure this bug needs to be s-s.

/be

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

This seems like the easiest fix. I don't think that buflength can wrap faster than bufsize, since bufsize grows exponentially and buflength grows by a constant factor of 256 each time.

Comment 3

[Brian Crowder]

Comment on attachment 267215 [details] [diff] [review]
Fix

Doesn't fall back to slower growth in the overflow case, but I sincerely doubt it will matter for a long time.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

Oops, forgot to report error in the overflow case.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Fixed on trunk.