View Issue Details [ Jump to Notes ] | [ Issue History ] [ Print ] | ||||||||
ID | Project | Category | View Status | Date Submitted | Last Update | ||||
---|---|---|---|---|---|---|---|---|---|
0002789 | LibDOM | [All Projects] General | public | 2020-08-16 00:21 | 2020-10-02 16:20 | ||||
Reporter | sha0sum | ||||||||
Assigned To | Daniel Silverstone | ||||||||
Priority | normal | Severity | crash | Reproducibility | always | ||||
Status | resolved | Resolution | fixed | ||||||
Summary | 0002789: Crashes found from fuzzing | ||||||||
Description | Fuzzing netsurf-gtk using Domato[1] found a few segfaults in LibDOM 0.4.1 (HEAD at 93b8a9bba18fc3166dd158484188b1730afdd382). Minimized test cases, along with corresponding AddressSanitizer stack traces, are attached. [1] https://github.com/googleprojectzero/domato | ||||||||
Tags | No tags attached. | ||||||||
Fixed in CI build # | |||||||||
Reported in CI build # | |||||||||
Attached Files |
|
![]() |
|
![]() sha0sum (reporter) 2020-08-16 18:37 |
Here is another crash input, caused by referencing rowIndex of an HTMLTableRowElement when there is no <thead> in the table: <script> window.onload = function () { row = document.getElementById("htmlvar00004"); row.rowIndex; } </script> <table> <!-- Crashes when no <thead> element --> <tr id="htmlvar00004"></tr> </table> |
Daniel Silverstone (administrator) 2020-10-02 16:20 |
Thanks for this, I've made appropriate fixes to our DOM bindings to deal with these. If you could let us know the best way to get domato and monkey working together we can add this to our CI. |
![]() |
|||
Date Modified | Username | Field | Change |
---|---|---|---|
2020-08-16 00:21 | sha0sum | New Issue | |
2020-08-16 00:21 | sha0sum | File Added: crashes.zip | |
2020-08-16 18:37 | sha0sum | File Added: 5.asan.txt | |
2020-08-16 18:37 | sha0sum | Note Added: 0002286 | |
2020-10-02 12:16 | Daniel Silverstone | Assigned To | => Daniel Silverstone |
2020-10-02 12:16 | Daniel Silverstone | Status | new => assigned |
2020-10-02 16:20 | Daniel Silverstone | Status | assigned => resolved |
2020-10-02 16:20 | Daniel Silverstone | Resolution | open => fixed |
2020-10-02 16:20 | Daniel Silverstone | Note Added: 0002295 |