View Issue Details [ Jump to Notes ] | [ Issue History ] [ Print ] | ||||||||
ID | Project | Category | View Status | Date Submitted | Last Update | ||||
---|---|---|---|---|---|---|---|---|---|
0002789 | LibDOM | [All Projects] General | public | 2020-08-15 23:21 | 2024-05-27 12:47 | ||||
Reporter | sha0sum | ||||||||
Assigned To | kinnison | ||||||||
Priority | normal | Severity | crash | Reproducibility | always | ||||
Status | resolved | Resolution | fixed | ||||||
Summary | 0002789: Crashes found from fuzzing | ||||||||
Description | Fuzzing netsurf-gtk using Domato[1] found a few segfaults in LibDOM 0.4.1 (HEAD at 93b8a9bba18fc3166dd158484188b1730afdd382). Minimized test cases, along with corresponding AddressSanitizer stack traces, are attached. [1] https://github.com/googleprojectzero/domato | ||||||||
Tags | No tags attached. | ||||||||
Fixed in CI build # | 6738 | ||||||||
Reported in CI build # | |||||||||
Attached Files |
|
Notes | |
sha0sum (reporter) 2020-08-16 17:37 |
Here is another crash input, caused by referencing rowIndex of an HTMLTableRowElement when there is no <thead> in the table: <script> window.onload = function () { row = document.getElementById("htmlvar00004"); row.rowIndex; } </script> <table> <!-- Crashes when no <thead> element --> <tr id="htmlvar00004"></tr> </table> |
kinnison (administrator) 2020-10-02 15:20 |
Thanks for this, I've made appropriate fixes to our DOM bindings to deal with these. If you could let us know the best way to get domato and monkey working together we can add this to our CI. |
kinnison (administrator) 2024-05-27 12:45 |
Turns out I hadn't fixed it |
kinnison (administrator) 2024-05-27 12:47 |
There were a couple of spots where table rows didn't check they had parents. Fixed. |
Issue History | |||
Date Modified | Username | Field | Change |
---|---|---|---|
2020-08-15 23:21 | sha0sum | New Issue | |
2020-08-15 23:21 | sha0sum | File Added: crashes.zip | |
2020-08-16 17:37 | sha0sum | File Added: 5.asan.txt | |
2020-08-16 17:37 | sha0sum | Note Added: 0002286 | |
2020-10-02 11:16 | kinnison | Assigned To | => kinnison |
2020-10-02 11:16 | kinnison | Status | new => assigned |
2020-10-02 15:20 | kinnison | Status | assigned => resolved |
2020-10-02 15:20 | kinnison | Resolution | open => fixed |
2020-10-02 15:20 | kinnison | Note Added: 0002295 | |
2024-05-27 12:45 | kinnison | Status | resolved => assigned |
2024-05-27 12:45 | kinnison | Note Added: 0002454 | |
2024-05-27 12:47 | kinnison | Status | assigned => resolved |
2024-05-27 12:47 | kinnison | Fixed in CI build # | => 6738 |
2024-05-27 12:47 | kinnison | Note Added: 0002455 |