375711 - "Assertion failure: c <= cs->length" [@ AddCharacterRangeToCharSet] with /[Q-b]/i

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

js> /[Q-b]/i.exec("")
Assertion failure: c <= cs->length, at jsregexp.c:2219

Security-sensitive for now because the code involved is playing with bit arrays.

0   js 	0x000c6904 JS_Assert + 70 (jsutil.c:60)
1   js 	0x000aa9ec AddCharacterRangeToCharSet + 111 (jsregexp.c:2235)
2   js 	0x000ab4ad ProcessCharSet + 2516 (jsregexp.c:2431)
3   js 	0x000ae558 InitMatch + 636 (jsregexp.c:3320)
4   js 	0x000ae752 js_ExecuteRegExp + 435 (jsregexp.c:3369)
5   js 	0x000b02e7 regexp_exec_sub + 1047 (jsregexp.c:4121)
6   js 	0x000b045b regexp_exec + 53 (jsregexp.c:4137)
7   js 	0x000574f3 js_Invoke + 2954 (jsinterp.c:1353)

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Wrong file

We need to upcase before we deal with character ranges when calculating the bitmap size since that's what ProcessCharSet does.

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Right file

Comment 3

[Brian Crowder]

Comment on attachment 260023 [details] [diff] [review]
Right file

+        if (state->flags & JSREG_FOLD) {
+            c = JS_MAX(upcase((jschar)localMax), downcase((jschar)localMax));

House-style on casts would be |(jschar) localMax|  (ie., with a space between cast closing-paren and the variable name, correct?

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Patch to check in

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into trunk.

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 260033 [details] [diff] [review]
Patch to check in

This fixes what I believe is a potentially-exploitable bug by simply moving existing code around.

Comment 7

[chris hofmann]

adding some branch nomination flags so it gets looked at after a bit of backing on the trunk

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 260033 [details] [diff] [review]
Patch to check in

approved for 1.8.0.12 and 1.8.1.4, a=dveditz for release-drivers

Comment 9

[Bob Clary [:bc] (inactive)]

Attachment: ecma_3/RegExp/regress-375111.js

Comment 10

[Bob Clary [:bc] (inactive)]

Attachment: ecma_3/RegExp/regress-375711.js

correct test name and bug number. I need a slurpee.

Comment 11

[Bob Clary [:bc] (inactive)]

verified fixed linux, windows, mac* shell 20070406

Comment 12

[Daniel Veditz [:dveditz]]

Blake: any chance you can check this in over the weekend once you're done with finals? We're planning on doing the branch RC1 builds on Monday (4/30)

Comment 13

[Blake Kaplan (:mrbkap) (inactive)]

Fixed on branches.

Comment 14

[Bob Clary [:bc] (inactive)]

verified fixed 1.8.0 1.8.1 1.9.0 windows/linux/mac* 20070427

Comment 15

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/ecma_3/RegExp/regress-375711.js,v  <--  regress-375711.js
initial revision: 1.1