783867 - (CVE-2012-3989) ASSERTION: This only works on nsISupports classes! and segfault

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Running

new Worker("http://base.com") instanceof Components.interfaces.nsIArray

in a mochitest will hit

NS_ASSERTION(mozilla::dom::DOMJSClass::FromJSClass(
                  js::GetObjectJSClass(obj))->mDOMObjectIsISupports,
             "This only works on nsISupports classes!");

at <http://mxr.mozilla.org/mozilla-central/source/js/xpconnect/src/XPCJSID.cpp#484>. We then unwrap the object to nsISupports and try to call QueryInterface on it, and segfault in nsWrapperCache::WrapObject.

Comment 1

[David Bolter [:davidb] (NeedInfo me for attention)]

How dangerous is this?

Comment 2

[Boris Zbarsky [:bzbarsky]]

This is reasonably bad.  It's also a regression from the original landing in bug 740069.

Probably too late to fix this on 15 now, but we should fix elsewhere.  Also, not check in a test for this until after we ship the fix.  :(

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Don't blindly assume IsDOMClass objects are nsISupports.

Comment 4

[Boris Zbarsky [:bzbarsky]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/2f60f3a4bdd7

No test landed yet; we should do that once we reopen it.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 654288 [details] [diff] [review]
Don't blindly assume IsDOMClass objects are nsISupports.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Bug 740069
User impact if declined: Possibly-exploitable crash
Testing completed (on m-c, etc.): Tested on testcase in this bug
Risk to taking this patch (and alternatives if risky): Very safe: just makes us
  return false in cases where it should be returned, instead of crashing
  exploitably.
String or UUID changes made by this patch:

Comment 6

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/236d384dc4f9

Comment 7

[Ed Morley [:emorley]]

Apologies, had two security bugs open to mark, and pasted other s-g bug's cset in this one.

The correct changeset is:
https://hg.mozilla.org/mozilla-central/rev/2f60f3a4bdd7

Comment 8

[Boris Zbarsky [:bzbarsky]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/5a76e53d11fc

Comment 9

[Al Billings [:abillings - ex-MoCo]]

Can someone suggest a sec rating for this issue?