Buffer overflow in Gamepad API

Buffer overflow in Gamepad API

Announced

June 10, 2014

Reporter

Looben Yang

Impact

High

Products

Firefox, SeaMonkey

Fixed in

• Firefox 30
• SeaMonkey 2.26.1

Description

Security researcher Looben Yang reported a buffer overflow in Gamepad API when it is exercised with a gamepad device with non-contiguous axes. This can be either an actual physical device or by the installation of a virtual gamepad. This results in a potentially exploitable crash. The Gamepad API was introduced in Firefox 29 and this issue does not affect earlier versions.

This issue occurs only on Windows 8 with a gamepad or virtual gamepad attached.

References

• Heap memory corruption by navigator.getGamepads() (CVE-2014-1543)