CVE-2006-0293

An attacker can trigger memory corruption by invoking user-defined methods that cause garbage collection to run while the engine is still operating on freed objects [ref_id=1]. The attack is network-based: a malicious web page can call crafted JavaScript methods that exploit the allocation ordering flaw. No authentication is required; the victim only needs to visit the attacker's page. The advisory notes that disabling JavaScript in the browser is impractical for most users [ref_id=1].

The vulnerability resides in the function allocation code (`js_NewFunction` in `jsfun.c`) in Firefox 1.5. The patch reorders allocations to avoid a 'pigeon-hole problem' where garbage collection could operate on freed objects during user-defined method creation [ref_id=1].

The patch reorders allocations in `jsfun.c` to ensure that objects are fully initialized before they become visible to the garbage collector [ref_id=1]. This prevents the 'pigeon-hole problem' where a GC cycle could free an object that the allocation code still holds a pointer to. The fix was checked into the trunk on 2006-01-02 and subsequently landed on the 1.8 and 1.8.0 branches [ref_id=1].