545927 - xslt number formatting function crashes on big numbers [@ txRomanCounter::appendNumber(int, nsAString_internal&) ]

Status: RESOLVED FIXED

(Core :: XSLT, defect)

Description

[Sergey Glazunov]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.0.249.89 Safari/532.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; ru; rv:1.9.2) Gecko/20100115 Firefox/3.6

Mozilla crashes while transforms a large number (like 1000000000000000) into the Roman numeral system using XSLT (<xsl:number value="1000000000000000" format="i"/>).

Reproducible: Always

Comment 1

[Sergey Glazunov]

Attachment: malformed xslt document

Comment 2

[Sergey Glazunov]

Attachment: xml file to open

Comment 3

[Marcia Knous [:marcia]]

I don't crash using  Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6. I tried using a trunk build and it seemed when I tried to shut down that Minefield closed. Do you have a crash report from about:crashes (in the URL bar)?

Comment 4

[Sergey Glazunov]

http://crash-stats.mozilla.com/report/index/8519a2ce-2535-46f5-80b3-31a892100213

Comment 5

[Sergey Glazunov]

i found out where the bug in the code is.
there is the check in the txRomanCounter::appendNumber method:
if (aNumber >= 4000) {
but aNumber is considered as signed int, so it passes the check if it equals at least 2147483648.

Comment 6

[Matthias Versen [:Matti]]

0  	xul.dll  	txRomanCounter::appendNumber  	 content/xslt/src/xslt/txXSLTNumberCounters.cpp:239
1 	xul.dll 	txXSLTNumber::createNumber 	content/xslt/src/xslt/txXSLTNumber.cpp:94
2 	xul.dll 	txNumber::execute 	content/xslt/src/xslt/txInstructions.cpp:597
3 	xul.dll 	txXSLTProcessor::execute 	content/xslt/src/xslt/txXSLTProcessor.cpp:104
4 	xul.dll 	txMozillaXSLTProcessor::TransformToDoc 	content/xslt/src/xslt/txMozillaXSLTProcessor.cpp:683

Comment 7

[Sergey Glazunov]

Attachment: one file javascript version

Comment 8

[Boris Zbarsky [:bzbarsky]]

Attachment: Proposed fix

Serg, thank you for the testcase and analysis!

Comment 9

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Comment on attachment 427251 [details] [diff] [review]
Proposed fix

Sweet, thanks guys!

Comment 10

[Boris Zbarsky [:bzbarsky]]

Pushed as http://hg.mozilla.org/mozilla-central/rev/4c8923d18e2e

I guess we should try to get this in on the branch too....

Comment 11

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 427251 [details] [diff] [review]
Proposed fix

Requesting approval for this "don't try to read memory we haven't mapped" fix.

Comment 12

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 427251 [details] [diff] [review]
Proposed fix

Uhm, isn't that the very definition of a security bug?

Comment 13

[Boris Zbarsky [:bzbarsky]]

> Uhm, isn't that the very definition of a security bug?

Well, it can be, yes.

Comment 14

[Daniel Veditz [:dveditz]]

Is the 1.9.1 branch affected as well?

Comment 15

[Daniel Veditz [:dveditz]]

Comment on attachment 427251 [details] [diff] [review]
Proposed fix

Approved for 1.9.2.5, a=dveditz for release-drivers

Comment 16

[Boris Zbarsky [:bzbarsky]]

> Is the 1.9.1 branch affected as well?

Yes.

Comment 17

[Boris Zbarsky [:bzbarsky]]

Pushed http://hg.mozilla.org/releases/mozilla-1.9.2/rev/db34c710c17e

Here's hoping I'm setting the status flag right... (i.e. NOT matching the approval flag).

Comment 18

[Daniel Veditz [:dveditz]]

Comment on attachment 427251 [details] [diff] [review]
Proposed fix

You did that right, thanks. We're a little off-kilter due to the decision to split Fennec 1.1 off mid-release.

Approved for 1.9.1.11, a=dveditz

Comment 19

[Boris Zbarsky [:bzbarsky]]

Pushed http://hg.mozilla.org/releases/mozilla-1.9.1/rev/3d53e20b39a5

Comment 20

[Al Billings [:abillings - ex-MoCo]]

Verified for 1.9.1.11 using testcase in comment 7 (which crashes 1.9.1.10): Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.11) Gecko/20100701 Firefox/3.5.11 (.NET CLR 3.5.30729).

Verified for 1.9.2.7 the same way with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.7) Gecko/20100713 Firefox/3.6.7 (.NET CLR 3.5.30729).