[Webkit-unassigned] [Bug 125929] New: Crash through integer overflow when regexp quantifiers exceed INT_MAX

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Wed Dec 18 09:44:23 PST 2013


https://bugs.webkit.org/show_bug.cgi?id=125929

           Summary: Crash through integer overflow when regexp quantifiers
                    exceed INT_MAX
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
               URL: https://bugzilla.mozilla.org/show_bug.cgi?id=872971
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: till at tillschneidereit.net


The testcase in [1] crashes JSC and Safari. We fixed this in the SpiderMonkey import of Yarr by clamping quantifiers to INT_MAX.

[1]: https://bugzilla.mozilla.org/show_bug.cgi?id=872971#c4

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.



More information about the webkit-unassigned mailing list