99667 - Crash in ParseAtom()

Status: VERIFIED DUPLICATE of bug 98306

(Core :: JavaScript Engine, defect)

Description

[Johnny Stenback (:jst)]

Loading the above url mozilla sometimes, not always, crashes in ParseAtom() in
the JS engine, the crash always seems to happen in the exact same place tho.

ParseAtom() is asked to parse the string "[", so |cp| points to the string "]"
and here's what happens:

  switch(*cp) {
    ...
    case '[' :
      cp++; // step over the '[', |cp| now points to the null terminator
      ...
      while ((c = *++cp) != ']') {
        ...
      }
  }

So |c = *++cp| steps past the null terminator and starts accessing memory beond
the end of the string.

Comment 1

[Johnny Stenback (:jst)]

Attachment: Offending JS file.

Comment 2

[Johnny Stenback (:jst)]

Attachment: Proposed fix.

Comment 3

[Phil Schwartau]

Confirmed - I believe this is bug 98306, however -

*** This bug has been marked as a duplicate of 98306 ***

Comment 4

[Phil Schwartau]

Marking Verified - 

Now that bug 98306 has been fixed, the URL given above loads without crashing
in both trunk and 0.9.4 branch builds on WinNT, Mac 9.1, and Linux.