554120 - Potential out-of-bounds memory read in nsStandardURL.cpp

Status: RESOLVED FIXED

(Core :: Networking, defect)

Description

[Justin Lebar (not reading bugmail)]

In nsStandardURL::GetRelativeSpec()

    while ((*(thatIndex-1) != '/') && (thatIndex != startCharPos))
        thatIndex--; 

Notice that we read from thatIndex-1 before we check that it's in range.

This is unlikely to cause a crash except under pathological conditions (startCharPos is at the start of a page, and the page before is unmapped), and the invalid read doesn't look exploitable since we do the range check immediately after, so this probably shouldn't be marked as a security bug.  But I'd like a second opinion before unmarking it.

Comment 1

[Justin Lebar (not reading bugmail)]

Attachment: Patch

Comment 2

[Christian :Biesinger (don't email me, ping me on IRC)]

Comment on attachment 433993 [details] [diff] [review]
Patch

all standardurls have a slash after the scheme. so, this should not be a problem. but sure.

Comment 3

[Justin Lebar (not reading bugmail)]

(In reply to comment 2)
I see.  Well...better safe than sorry.  :)

Comment 4

[Dão Gottwald [:dao]]

Patch failed to apply.

Comment 5

[Justin Lebar (not reading bugmail)]

Attachment: Patch with MQ headers

Maybe this patch will apply?  I rebased, but that didn't change the patch, so I'm not sure why it didn't work originally.

In any case, the old patch didn't include MQ headers, which certainly should be there.

Comment 6

[Dão Gottwald [:dao]]

http://hg.mozilla.org/mozilla-central/rev/0bab0ee2767e