Closed Bug 626297 (CVE-2011-2983) Opened 10 years ago Closed 9 years ago
regexp-statics possibly allows to read private data
Seems like a dup of bug 610223. /be
(In reply to comment #1) > Seems like a dup of bug 610223. That bug was marked as a trunk-only YARR regression that didn't affect 1.9.2.
Assignee: general → cdleary
Whiteboard: DUPEME → [sg:moderate?]
(In reply to comment #2) > That bug was marked as a trunk-only YARR regression that didn't affect 1.9.2. Yeah, I assumed YARR introduced it -- are our regression tests being backported to 1.9.2 at all? I don't know how that process works.
Status: NEW → ASSIGNED
(In reply to comment #4) > Yeah, I assumed YARR introduced it -- are our regression tests being backported > to 1.9.2 at all? I don't know how that process works. Not in general. Sometimes/often the regression tests are checked in to the branch along with a specific security bug back-port. Since the YARR regression didn't affect the branches its patch (and therefore regression tests) were not checked in. We don't always check in tests, depending on how obviously they point at the vulnerability we often wait until we've issued fixes and advisories for the supported branches before checking them in. We set the in-testsuite flag to "?" to remind us to go back and do so.
blocking1.9.1: .19+ → ?
blocking1.9.2: .17+ → ?
blocking2.0: --- → ?
Patch against mc-192. User only has access to res->pendingInput through the object interface. res->input is set iff a successful match is performed or (friend API) js_ClearRegExpStatics is called for save/restore junk; failure in the regexp execution clears the statics entirely.
Attachment #526428 - Flags: review?(mrbkap)
Attachment #526428 - Flags: review?(mrbkap) → review+
Comment on attachment 526428 [details] [diff] [review] Add pending input. Maybe that was the wrong ? to set.
Comment on attachment 526428 [details] [diff] [review] Add pending input. a=LegNeato for 18.104.22.168.
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
No longer depends on: multicore
Verified fixed in 22.214.171.124 (Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.7; en-US; rv:126.96.36.199) Gecko/20110803 Firefox/3.6.20) using code in comment 0. No longer leaking private data as we are in 188.8.131.52 when I tested it.
Al, why did you move this from .20-fixed to .21-fixed? Did this not make the build?
I did not purposefully change the keyword.
You need to log in before you can comment on or make changes to this bug.