95517 - encodeURI[Component] memory corruption

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Mike Epstein]

Encode(), called by encodeURI() and encodeURIComponent(), assumes that a 
shrinking realloc always returns the same buffer.  On Solaris, that is not true 
for realloc of buffers smaller than 32 bytes, so encodeURI() of a string under 
16 (double-byte) characters results in a JSString whose "chars" don't belong to 
it, leading to possibly corrupt results.

I will attach the trivial patch shortly.

Comment 1

[Mike Epstein]

Attachment: patch

Comment 2

[Mike Epstein]

Decode() has the same problem.  New patch coming.

Comment 3

[Mike Epstein]

Attachment: patch Decode() too

Comment 4

[Mike Epstein]

Attachment: This is embarrassing. Ignore previous patches.

Comment 5

[Phil Schwartau]

Formally confirming; reassigning to khanson; cc'ing Brendan - 

Comment 6

[Brendan Eich [:brendan]]

Shrinking reallocs are allowed to move, indeed.  r/sr=[e-mail] on
Mike's last patch (although prevailing style puts a space after the cast, and in
the cast before the * -- (jschar *) JS_realloc(...) -- style nit of the day).

/be

Comment 7

[Brendan Eich [:brendan]]

Let's get this in ASAP for 0.9.4, no reason to miss that boat.

/be

Comment 8

[Brendan Eich [:brendan]]

Just need an r=, I'll do the checkin.  Sorry for the spam!

/be

Comment 9

[Brendan Eich [:brendan]]

Attachment: proposed fix, check for JS_realloc success before updating R->chars

Comment 10

[Brendan Eich [:brendan]]

Looking for another sr=, as well as r=.

/be

Comment 11

[John Bandhauer]

r/sr=jband

Comment 12

[Brendan Eich [:brendan]]

Fix checked in.

/be

Comment 13

[Phil Schwartau]

Marking Verified -