989665 - Worker console: "Assertion failure: strings->Length() <= aData"

Status: RESOLVED FIXED

(Core :: DOM: Workers, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Assertion failure: strings->Length() <= aData, at dom/base/Console.cpp:77

Comment 1

[Jesse Ruderman]

Bug 989666 has a related testcase that asserts elsewhere.

Comment 2

[Andrea Marchesini [:baku]]

Attachment: crash.patch

Comment 3

[Ben Turner (not reading bugmail, use the needinfo flag!)]

This doesn't look s-s if that patch is all that's needed here.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8399049 [details] [diff] [review]
crash.patch

Er, yes.

Comment 5

[Andrea Marchesini [:baku]]

Comment on attachment 8399049 [details] [diff] [review]
crash.patch

[Security approval request comment]
How easily could an exploit be constructed based on the patch?
Hard. just debug builds.

Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?
Almost.

Which older supported branches are affected by this flaw?
0

If not all supported branches, which bug introduced the flaw?
bug 965860

How likely is this patch to cause regressions; how much testing does it need?
There is a mochitest included in the patch.

Comment 6

[Al Billings [:abillings - ex-MoCo]]

This can't be approved for checkin without a security rating. Do you have a suggested rating here? How exploitable is this?

By "0" branches being affected, do you mean that this is entirely Trunk only? If that's the case, it doesn't need sec-approval and can just be checked in (see https://wiki.mozilla.org/Security/Bug_Approval_Process for details).

Comment 7

[Andrea Marchesini [:baku]]

(In reply to Al Billings [:abillings] from comment #6)
> This can't be approved for checkin without a security rating. Do you have a
> suggested rating here? How exploitable is this?

I don't think it's exploitable at all. It was a MOZ_ASSERT used on debug builds only.

> 
> By "0" branches being affected, do you mean that this is entirely Trunk
> only? If that's the case, it doesn't need sec-approval and can just be
> checked in (see https://wiki.mozilla.org/Security/Bug_Approval_Process for
> details).

Right. I think Console API in C++ is still in trunk only.

Comment 8

[Andrea Marchesini [:baku]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/61b1f28c3c16

Comment 9

[Carsten Book [:Tomcat]]

landed https://hg.mozilla.org/mozilla-central/rev/61b1f28c3c16

Comment 11

[Al Billings [:abillings - ex-MoCo]]

Comment on attachment 8399049 [details] [diff] [review]
crash.patch

Clearing sec-approval flag.