599188 - potential overflow in shell ShapeOf

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brian Hackett [Laid off!]]

ShapeOf can read vp[2] if argc == 0.  Here is the relevant code:

static JSBool
ShapeOf(JSContext *cx, uintN argc, jsval *vp)
{
    jsval v = JS_ARGV(cx, vp)[0];
...

Comment 1

[Andreas Gal :gal]

Shell only. We don't have to block on this.

Comment 2

[Andreas Gal :gal]

Attachment: patch

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 478139 [details] [diff] [review]
patch

Traveling, going to ignore mail in a minute. Suggest jorendorff since luke is on paternity leave.

Also suggest not nesting v = ... in actual argument to what was once a macro, but that's a style thing at this point. It does highlight that v is single use and really unnecessary, though!

/be

Comment 4

[Jonathan Watt [:jwatt]]

Please remove the checkin-needed keyword and request approval.

Comment 5

[Jason Orendorff [:jorendorff]]

http://hg.mozilla.org/tracemonkey/rev/83858adedebc

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/83858adedebc