691299 - (CVE-2011-3661) Crash at js::RegExp::executeInternal

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Aki Helin]

Attachment: regex.html

User Agent: Mozilla/5.0 (X11; Linux i686; rv:8.0) Gecko/20100101 Firefox/8.0
Build ID: 20110928060149

Steps to reproduce:

I stumbled into another regexp issue similar to https://bugzilla.mozilla.org/show_bug.cgi?id=653672. That one was fixed in Firefox 7.0, but this one remains in it and 8.0 beta. Filing as a security bug based on the high crash address and probability of there being a similar integer error.


Actual results:

Firefox 7.0 / Linux (64-bit Debian 6.0.2) -> https://crash-stats.mozilla.com/report/index/2b6d78d1-df97-4497-bbcc-b3fae2111003

Firefox 8.0 beta / ditto-> https://crash-stats.mozilla.com/report/index/bp-82827ac7-07c6-4f97-a697-5f1202111003


Expected results:

Firefox shouldn't have crashed and I should have caught this earlier.

Comment 1

[Aki Helin]

Open the attached file to reproduce. Firefox usually appears to get stuck for a few seconds and then crashes. Some pages exhibiting this crash instantly. I tried to make a small repro that crashes most of the time on different versions.

Firefox 8.0 on 32-bit Debian crashed with a slightly different signature [@ JSC::Yarr::execute ] -> https://crash-stats.mozilla.com/report/index/bp-180837cb-6a6f-440f-a900-b859c2111003

Comment 2

[Marcia Knous [:marcia]]

Using Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:10.0a1) Gecko/20111003 Firefox/10.0a1 I don't crash, but Nightly stops responding and I have to force quit.

Comment 3

[Aki Helin]

Firefox 7.0.1 / Windows 7 -> https://crash-stats.mozilla.com/report/index/bbba3892-7e36-40d5-963e-93b422111004

Comment 5

[Daniel Veditz [:dveditz]]

Haven't tested nightly yet, but have we updated YARR since Fx8?

Comment 6

[Chris Leary [:cdleary] (not checking bugmail)]

Attachment: Error check regexp quantifier in parser and alternative offset in emitter.

Comment 7

[David Mandelin [:dmandelin]]

Can you report this to WebKit and attach that patch to see if they want to upstream it?

Comment 8

[Chris Leary [:cdleary] (not checking bugmail)]

(In reply to David Mandelin from comment #7)
> Can you report this to WebKit and attach that patch to see if they want to
> upstream it?

Will do. I actually missed one shell test failure as well. Will post the link when I fix that and submit to their tracker.

Comment 9

[Daniel Veditz [:dveditz]]

Can we get the webkit bug link added to this bug?

Comment 10

[David Mandelin [:dmandelin]]

Comment on attachment 565697 [details] [diff] [review]
Error check regexp quantifier in parser and alternative offset in emitter.

Review of attachment 565697 [details] [diff] [review]:
-----------------------------------------------------------------

Chris says the patch has a problem and needs refreshing.

Comment 11

[Chris Leary [:cdleary] (not checking bugmail)]

Attachment: Error check regexp quantifier in parser and alternative offset in emitter.

Fixes the problem. Will post to webkit bug tracker now.

Comment 12

[Johnny Stenback (:jst)]

Too late for 8 given the complexity of this patch.

Comment 13

[David Mandelin [:dmandelin]]

Do we want this for 9?

Comment 14

[Johnny Stenback (:jst)]

Yes please.

Comment 15

[Johnny Stenback (:jst)]

Chris, what's left here?

Comment 16

[Chris Leary [:cdleary] (not checking bugmail)]

Comment on attachment 568767 [details] [diff] [review]
Error check regexp quantifier in parser and alternative offset in emitter.

No feedback from WebKit. Requesting approval for aurora / beta landing ASAP.

Comment 17

[Alex Keybl [:akeybl]]

Comment on attachment 568767 [details] [diff] [review]
Error check regexp quantifier in parser and alternative offset in emitter.

[Triage Comment]
Please re-nominate for approval once this has landed on m-c.

Comment 18

[Chris Leary [:cdleary] (not checking bugmail)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/bbda472dc34b

Comment 19

[Chris Leary [:cdleary] (not checking bugmail)]

https://hg.mozilla.org/mozilla-central/rev/bbda472dc34b

Re-nom coming per comment 17.

Comment 20

[David Mandelin [:dmandelin]]

Marking FIXED since this landed on m-c.

Comment 21

[Alex Keybl [:akeybl]]

Comment on attachment 568767 [details] [diff] [review]
Error check regexp quantifier in parser and alternative offset in emitter.

[Triage Comment]
Let's take this on both aurora and beta - this is critical and we expect to find any regressions quickly (if there are any).

Comment 22

[Chris Leary [:cdleary] (not checking bugmail)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/f2fb79b0d7d2
https://hg.mozilla.org/releases/mozilla-beta/rev/7709a40b7919

Comment 23

[u279076]

Crash no longer reproducible with 2011-12-08 Nightly and Aurora, and Firefox 9.0b5.

Comment 24

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug691299-regexp.js.

Comment 25

[Raymond Forbes[:rforbes]]

rforbes-bugspam-for-setting-that-bounty-flag-20130719