894956 - Use-After-Free with JS::CompileOptions

Status: RESOLVED DUPLICATE of bug 893684

(Core :: JavaScript Engine, defect)

Description

[Bobby Holley (:bholley)]

This is being discussed in another bug, but I'm pretty sure it's s-s. So I'm filing a security bug here.

Basically, asm.js does a shallow copy of CompileOptions, and sticks it on the heap (see bug 892643 comment 5). But CompileOptions has a caller-allocated filename char*. And while there's no explicitly-documented contract of its lifetime, the only sane thing to assume is that it's stack-scoped along with the CompileOptions struct. So when we stick a copy of CompileOptions on the heap, we end up with a pointer to soon-to-be-dead memory, which is likely to cause a use-after-free.

This is blocking gabor in bug 877673.

Comment 1

[Bobby Holley (:bholley)]

(though actually we may never write to it, so it might not be sec-critical. But either way this is simple enough that we should just fix it pronto).

Comment 2

[Luke Wagner [:luke]]

Fix should land today.