50702 - UTF-8 decoder accepts overlong sequences

Status: VERIFIED FIXED

(Core :: Internationalization, defect, P3)

Description

[John G. Myers]

The UTF-8 decoder incorrectly accepts overlong sequences, leaving a potential
path for attackers to get past input validation.

Comment 1

[John G. Myers]

Attachment: Proposed fix

Comment 2

[Frank Tang]

john- sorry, I have no idea what do you mean "overlong sequences"  can you put 
some example here and describe the problem clearly?

Comment 3

[John G. Myers]

Section 4 of the URL associated with this bug contains a full description and 
numerous examples of overlong sequences.

Comment 4

[John G. Myers]

An overlong sequence is a character that is encoded in UTF-8 using more octets 
than necessary.  For example, the UTF-8 sequence "c0 af" is currently decoded by 
Mozilla's UTF-8 decoder as U+002F.  This is a security problem as it would 
allow, for example, an attacker to get a U+002F character past an input validity 
checker which attempts to prohibit U+002F characters by prohibiting "2f" octets 
in data it knows is in UTF-8.

As another example, an attacker could encode a U+0000 character as "c0 80", 
allowing the attacker to truncate a string that is U+0000 terminated.

Comment 5

[Frank Tang]

>leaving a potential path for attackers to get past input validation.
???
1. i don't think we currently have any "input validation" in our code.
2. If we do, we should do that in the UCS2 space, not in the UTF8 space. 

Comment 6

[Frank Tang]

erik- can you help to fix this ? Mark it as M23

Comment 7

[Roozbeh Pournader]

This is now necessary, since The Unicode Standard version 3.0.1 forbids
accepting overlong sequences. Take a look at:
http://www.unicode.org/unicode/uni2errata/UTF-8_Corrigendum.html

Comment 8

[John G. Myers]

Attachment: Updated patch. Handles surrogates and prohibited chars

Comment 9

[Christopher Blizzard (:blizzard)]

What's the status on this bug?  Who is waiting on reviews, etc?

Comment 10

[John G. Myers]

I am waiting for a review.  I have heard nothing.

Comment 11

[Frank Tang]

reassign to ftang mark it as moz 0.9

Comment 12

[Frank Tang]

accept

Comment 13

[Frank Tang]

sr=ftang

Comment 14

[Frank Tang]

wait, I want to look at it again.

Comment 15

[Frank Tang]

I read it again. It is ok. sr=ftang again.

Comment 16

[John G. Myers]

That's r=ftang as well?

Comment 17

[Erik van der Poel]

ftang is not on the super reviewer list, but I am. sr=erik
(Maybe ftang can change his sr to r.)

Comment 18

[John G. Myers]

Fix checked in.

Comment 19

[Teruko Kobayashi]

Verified as fixed (2-22 trunk build).