Closed Bug 698139 Opened 13 years ago Closed 13 years ago

[meta] Dense array overflows

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED INVALID

People

(Reporter: terrence, Assigned: terrence)

References

Details

(Whiteboard: [sg:nse meta])

I found at least one potentially exploitable overflow in InitArrayElements, and I think several others that I am in the process of understanding.
Depends on: 698140
Whiteboard: [sg:nse meta]
Depends on: 699674
I was missing a core assumption of the DenseArray paths: DenseArray size is int32, not uint32. The code looks much safer with this knowledge.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → INVALID
Group: core-security
You need to log in before you can comment on or make changes to this bug.