740609 - Crash [@ JS_HashString] under js::SaveScriptFilename

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Might be a regression from bug 739694.

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Luke Wagner [:luke]]

Hmph, apparently script->filename can be null.

Comment 3

[Daniel Veditz [:dveditz]]

Stack looks like a null deref (also noted in comment 2). Is there a worry about exploitability here or can we call this a DoS?

Comment 4

[Luke Wagner [:luke]]

JS_HashString starts touching at offset 0, so safe low-memory fault.

Comment 5

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: patch

Comment 6

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8cf633d7a031

Comment 7

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/8cf633d7a031