556874 - PoolObject::parseMultiname and Verifier::checkTypeName can recurse arbitrarily deep

Status: VERIFIED FIXED

(Tamarin Graveyard :: Virtual Machine, defect, P2)

Description

[Steven Johnson]

When parsing parameterized types, the code recurses as deep as the level of paramterizing. A carefully constructed ABC could make use of this to force a stack overflow.

Comment 1

[Steven Johnson]

Correction: with the proposed patch for bug 556543, PoolObject::parseMultiname can't recurse arbitrarily deep, but Verifier::checkTypeName (and Interpreter::getTraits) can.

Comment 2

[Steven Johnson]

PoolObject::resolveTypeName is also susceptible.

Comment 3

[Steven Johnson]

I've fiddled around with various rewrite attempts to unroll the recursion, but it's awkward and feels a bit too fiddly for this stage of the game, so I'm tempted to just insert a call to stackCheck() before the recursive bits. Thoughts?

Comment 4

[Steven Johnson]

Attachment: Patch

Minimal fix that merely inserts calls to stackCheck in the possible recursion cases.

Comment 5

[Edwin Smith]

Comment on attachment 436800 [details] [diff] [review]
Patch

patch is okay as long as the bug has been vetted for exploitability.  the fuzzer bugs were marked as security by default, but get declassified unless the represent a real exploit in shipping code.  

all the other stack overflow checking bugs for example (see 504506) are not marked as security.

Comment 6

[Dan Smith]

Declassify.

Comment 7

[Steven Johnson]

http://hg.mozilla.org/tamarin-redux/rev/2026a6bc0146
http://asteam.macromedia.com/hg/tamarin-redux-argo/rev/2026a6bc0146

Comment 8

[Chris Peyer]

Regression media depends on abcasm multiname support being added: See Bug 558956

Comment 9

[Tom Harwood]

(In reply to comment #8)
> Regression media depends on abcasm multiname support being added: See Bug
> 558956

Looks like abcasm needs TypeName and a way to create a qualified QName.  This also interacts with another bug in the parser -- abcasm also needs what amount to soft statement breaks at line breaks.