STR: Run the attached .html file. Observed: The page prints "0". Expected: Creating the ArrayBuffer should fail, and the page should throw an error "RangeError: invalid array length". (Works in Chrome)

Buffers larger than 4GB are definitely allowed by ES-2015. (Obviously there's a bug here though.)

Oh right - I was expecting it to throw since creating an ArrayBuffer of size 2^32-1 did throw, but of course getting a 4GB ArrayBuffer would be an ok result as well. (I think we currently have a limit of 2^31-1 bytes on ArrayBuffer size)

Looking at the creation code, it's a bit messy and arguably incorrect but almost certainly safe. It performs a ToInt32 operation, so sizes between 2GB and 4GB are illegal but then 4GB to 6GB is legal again. It should use ToLength and then do a proper check on the length. The create() method takes a uint32 but does not check that it is a uint32 in the proper range, notably it rounds the uint32 up to the page size so the strictly largest byte length for an ArrayBuffer is probably 4GB - pagesize. Elsewhere we have guards on the length being < 2GB.

Marking s-s because correctness is not obvious. No smoking gun yet.

Lars: did you decide this was a security bug that needs to remain hidden, and if so what is it's severity? Or is everything OK here.

Daniel: I don't think I ever finished the investigation, I was sidetracked (still am).

I'm just going to mark this sec-audit for now. Please adjust or clear the rating if you determine there to be an issue here. Thanks.

Talked with Lars about this. I'm just going to fix the argument handling in the open bug (bug 1255128).

(In reply to Jason Orendorff [:jorendorff] from comment #9) > Talked with Lars about this. I'm just going to fix the argument handling in > the open bug (bug 1255128). Taking ownership for bookkeeping and to ensure that this doesn't slip through the cracks once we fix bug 1255128.

Any updates on this?

Is there a timeline we want/need to get this fixed?

Didn't Tom fix this with his ToIndex work, recently?

Yeah, this looks fixed in current code by bug 1255128, and stepping through in a debugger, it properly throws.