New issue
Advanced search Search tips

Issue 773320 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Oct 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug

Blocking:
issue 758236



Sign in to add a comment

UTF-8 decoding produces incorrect results when an erroneous byte sequence is split into multiple chunks

Project Member Reported by marja@chromium.org, Oct 10 2017

Issue description

In the orig. bug, this web site crashes V8:

https://www.dallascounty.org/services/record-search/

The problem is in this script: https://www.dallascounty.org/web_resources/cm/common/js/perc_common_ui.js

Near byte position: 180224

An invalid byte sequence occurs and is split between two chunks (of size 4096):

0b11100000 << lead << 0xe0
0b10100101 << cont << 0xa5
0b00111111 << ascii << 0x3f

The bug is that TextCodecUTF8::HandlePartialSequence calls TextCodecUTF8::HandleError which assumes that each error consumes one byte from the byte stream and produces an invalid char. However, that ignores the fact that we need to consume multiple bytes (i.e., the maximal subpart).

This bug is probably very old, but it was only recently exposed since a new V8 feature CHECKs that function positions are what we'd expect them to be. Normally, stuff works just fine if function positions are off by one.
 
test10.js
4.4 KB View Download
test10.html
156 bytes View Download

Comment 1 by marja@chromium.org, Oct 10 2017

Cc: mathias@chromium.org vogelheim@chromium.org cbruni@chromium.org

Comment 2 by marja@chromium.org, Oct 10 2017

Blocking: 758236

Comment 3 by marja@chromium.org, Oct 11 2017

Components: Blink>TextEncoding
Owner: marja@chromium.org

Comment 4 by jsb...@chromium.org, Oct 11 2017

Cc: jsb...@chromium.org js...@chromium.org

Comment 5 by jsb...@chromium.org, Oct 11 2017

Code is old enough that WebKit likely has the same lurking issue:

https://trac.webkit.org/browser/webkit/trunk/Source/WebCore/platform/text/TextCodecUTF8.cpp

Point them at a fix once we have one?

Comment 6 by marja@chromium.org, Oct 12 2017

https://chromium-review.googlesource.com/c/chromium/src/+/711846 is the fix, I'm trying to land it right now...

Comment 7 by marja@chromium.org, Oct 12 2017

https://bugs.webkit.org/show_bug.cgi?id=178207 << WebKit bug submitted.

Comment 9 by marja@chromium.org, Oct 13 2017

Status: Fixed (was: Untriaged)

Comment 10 by ddkil...@apple.com, Oct 14 2017

> https://bugs.webkit.org/show_bug.cgi?id=178207 << WebKit bug submitted.

Thanks for the bug!

Sign in to add a comment