I ran into this issue while fuzzing. ASAN reports this as a heap overflow. I wasn't able to symbolize the ASAN output for some unknown reason. However, I see it crashing at strange locations on different runs on optimized builds.
In debug builds, it hits this assertion and crashes @ NULL:
Assertion failure: mLength + 1 <= mReserved, at ./../../dist/include/js/Vector.h:788
Windbg references this code: mozjs!str_unescape+0x23e [e:\builds\moz2_slave\rel-m-rel-w32-bld\build\js\src\jsstr.cpp @ 352]
I have attached some logs from both debug and optimized builds.
Created attachment 647033 [details]
ASAN Debug Build Output
Created attachment 647034 [details]
ASAN Optimized Build Output
Created attachment 647035 [details]
Windbg Debug Build Output
Created attachment 647036 [details]
Windbg Optimized Build Output
Created attachment 647038 [details]
Thanks for reporting! The test-case reproduces in the shell. A debug build asserts early reporting a call to infallibleAppend that has not reserved enough space.
Bug 708873 seems to be at fault; unfortunately the author is gone and the reviewer is on vacation. I guess I'll look at it.
(cc'ing Jesse for fuzzer fodder.)
Created attachment 648015 [details] [diff] [review]
Oh my, the bug is much simpler than that: there is an unsigned underflow in the expression (k > length - 6) when length < 6.
Unfortunately, bug 708873 went out with FF11.
Per luke's request, I landed this fix on m-c inside an inbound merge commit rather than with its own changeset. You can confirm that the fix is present there.
This bug was marked sec-high early before we understood the nature of the vulnerability. Understanding what the bug is now (out of bounds read), is that still appropriate? Will any part of this code write into an area assuming there's enough space because of the bogus length or it is only the read path that goes wrong?
IIRC, there was the possibility of writing past the end of the buffer (infallibleAppend is being used), so this sec-high sounds appropriate.
mass remove verifyme requests greater than 4 months old