Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionWhen segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash.
ComponentSpiderMonkey
Bug ClassLogic Error
Tracker1933023
Fix commit6a1bdb80cb57 (firefox) +15/-5
CISA KEVNot listed
CreditedNils Bars
Disclosed2025-01-07

Files Changed

  • js/src/builtin/intl/Segmenter.cpp
  • js/src/builtin/intl/Segmenter.h
diff --git a/js/src/builtin/intl/Segmenter.cpp b/js/src/builtin/intl/Segmenter.cpp
index 437a2f1a5d6..ab1f09a87be 100644
--- a/js/src/builtin/intl/Segmenter.cpp
+++ b/js/src/builtin/intl/Segmenter.cpp
@@ -574,7 +574,7 @@ static void DestroyBreakIterator(const T* segments) {
   void* brk = segments->getBreakIterator();
   MOZ_ASSERT(brk);
 
-  bool isLatin1 = segments->getString()->hasLatin1Chars();
+  bool isLatin1 = segments->hasLatin1StringChars();
 
   switch (segments->getGranularity()) {
     case SegmenterGranularity::Grapheme: {
@@ -660,7 +660,7 @@ static Boundaries FindBoundaryFrom(Handle<T*> segments, int32_t index) {
 template <typename T>
 static Boundaries GraphemeBoundaries(Handle<T*> segments, int32_t index) {
 #if defined(MOZ_ICU4X)
-  if (segments->getString()->hasLatin1Chars()) {
+  if (segments->hasLatin1StringChars()) {
     return FindBoundaryFrom<GraphemeClusterSegmenter::BreakIteratorLatin1>(
         segments, index);
   }
@@ -674,7 +674,7 @@ static Boundaries GraphemeBoundaries(Handle<T*> segments, int32_t index) {
 template <typename T>
 static Boundaries WordBoundaries(Handle<T*> segments, int32_t index) {
 #if defined(MOZ_ICU4X)
-  if (segments->getString()->hasLatin1Chars()) {
+  if (segments->hasLatin1StringChars()) {
     return FindBoundaryFrom<WordSegmenter::BreakIteratorLatin1>(segments,
                                                                 index);
   }
@@ -687,7 +687,7 @@ static Boundaries WordBoundaries(Handle<T*> segments, int32_t index) {
 template <typename T>
 static Boundaries SentenceBoundaries(Handle<T*> segments, int32_t index) {
 #if defined(MOZ_ICU4X)
-  if (segments->getString()->hasLatin1Chars()) {
+  if (segments->hasLatin1StringChars()) {
     return FindBoundaryFrom<SentenceSegmenter::BreakIteratorLatin1>(segments,
                                                                     index);
   }
@@ -782,7 +782,7 @@ static bool EnsureBreakIterator(JSContext* cx, Handle<T*> segments,
   }
 
 #if defined(MOZ_ICU4X)
-  bool isLatin1 = segments->getString()->hasLatin1Chars();
+  bool isLatin1 = segments->hasLatin1StringChars();
 
   // Create a new break iterator based on the granularity and character type.
   void* brk;
diff --git a/js/src/builtin/intl/Segmenter.h b/js/src/builtin/intl/Segmenter.h
index 3b204578b45..2b75b864882 100644
--- a/js/src/builtin/intl/Segmenter.h
+++ b/js/src/builtin/intl/Segmenter.h
@@ -198,6 +198,11 @@ class SegmentsObject : public NativeObject {
     setFixedSlot(STRING_CHARS_SLOT, PrivateValue(chars.tagged()));
   }
 
+  bool hasLatin1StringChars() const {
+    MOZ_ASSERT(hasStringChars());
+    return getStringChars().has<JS::Latin1Char>();
+  }
+
   int32_t getIndex() const {
     const auto& slot = getFixedSlot(INDEX_SLOT);
     if (slot.isUndefined()) {
@@ -295,6 +300,11 @@ class SegmentIteratorObject : public NativeObject {
     setFixedSlot(STRING_CHARS_SLOT, PrivateValue(chars.tagged()));
   }
 
+  bool hasLatin1StringChars() const {
+    MOZ_ASSERT(hasStringChars());
+    return getStringChars().has<JS::Latin1Char>();
+  }
+
   int32_t getIndex() const {
     const auto& slot = getFixedSlot(INDEX_SLOT);
     if (slot.isUndefined()) {
Loading diff…