576020 - OOB access when applying the slice() method to incorrect objects

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Sergey Glazunov]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.2 (KHTML, like Gecko) Chrome/6.0.451.0 Safari/534.2
Build Identifier: 

Simple repro:
a = Int8Array(0x1000000);
b = Int32Array.prototype.slice.apply(a, [0, 0x1000000]);
//We can now access 4 times more data than the array buffer contains.
alert(b[0x1000000 - 1]);

Clearly it can lead to arbitrary code execution.

Reproducible: Always

Comment 1

[Benjamin Smedberg]

What version of Firefox were you testing against?

Comment 2

[Daniel Veditz [:dveditz]]

bp-ffe619dc-3efc-44c7-a2a5-907ca2100630 on trunk

Comment 3

[Boris Zbarsky [:bzbarsky]]

Vlad?

Comment 4

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Man am I starting to hate dynamic languages.. slice() just needs to check that the array type is what it expects.  Will patch tomorrow.

Comment 5

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: fix

Here's the fix.  We just add a check into slice().

Comment 6

[Jason Orendorff [:jorendorff]]

Comment on attachment 455574 [details] [diff] [review]
fix

I think this bug is a duplicate of bug 571014. The fix is already in.

The test is welcome, though, if we don't already have a test like that.

Comment 7

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Not sure if it is -- slice() is the only method on typed arrays, so the only one that can be used with apply this way.  The other bug was mainly dealing with properties, and just walks the proto chain until it finds a typed array. That will still succeed in this case, but it'll still be the wrong type.  Also applying slice to a non-typed-array will likely walk the proto chain up to NULL (I guess?), and then the getPrivate() would crash.

Comment 8

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

http://hg.mozilla.org/mozilla-central/rev/8a745dc12044