615859 - Deserialize with null argument crashes/asserts

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.12) Gecko/20101027 Ubuntu/10.10 (maverick) Firefox/3.6.12
Build Identifier: 

Problem affects mozilla-2.0 branch only, tested on tip and current beta:

The code

deserialize(null);

will assert with Assertion failure: obj, at jstypedarray.cpp:1613 in a debug build and crash due to null ptr dereference in an optimized build.

Not exploitable, but should be fixed anyways :) Flagged as security bug as I don't know what your policy is with respect to crash bugs that are definitely not exploitable beyond denial of service, so feel free to remove flagging.

Reproducible: Always

Steps to Reproduce:
1. Run deserialize(null); as javascript code
2. Observe crash
Actual Results:  
Crash/Assert

Expected Results:  
Some kind of error message

Comment 1

[Benjamin Smedberg]

Yeah, we don't need to leave this private, it's at most an DOS (unexploitable crash).

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

I can only find Deserialize() in shell/js.cpp - was your crash in the browser or shell? If this is shell only it should unblock.

Comment 3

[Christian Holler (:decoder)]

Sorry, I was not aware that deserialize() is indeed only a shell function. Yes this was observed in the shell, but I thought the interface is accessible in browser as well.

Comment 4

[Christian Holler (:decoder)]

Another cosmetical problem of the same category (will assert only) deserialize(new Uint8ClampedArray(1));

Comment 5

[Jason Orendorff [:jorendorff]]

The bug from comment 0 is a silly rookie mistake on my part. Definitely shell only. Trivial to fix.

Comment 6

[Jason Orendorff [:jorendorff]]

Attachment: v1

Comment 7

[Jason Orendorff [:jorendorff]]

https://hg.mozilla.org/tracemonkey/rev/2ff422400823

Comment 8

[Chris Leary [:cdleary] (not checking bugmail)]

http://hg.mozilla.org/mozilla-central/rev/2ff422400823