1018829 - Use-after-free at CSP Parser

Status: RESOLVED FIXED

(Core :: DOM: Security, defect)

Description

[Makoto Kato [:m_kato]]

Attachment: Fix

This code is use-after-free.

const char16_t *formatParams[] = { NS_ConvertUTF8toUTF16(newUriSpec).get() };
...
// use formatParams

This code means,

const char16_t *formatParams[1];
{
  NS_ConvertUTF8toUTF16 unicodeSpec(newUrlSpec);
  formatParams[0] = unicodeSpec.get();
}
...
// use formatParams

So formatParams[0] becomes use-after-free.

Comment 1

[Benjamin Smedberg]

The code in question landed for FF32 in bug 951457.

Comment 2

[Sid Stamm [:geekboy or :sstamm]]

Comment on attachment 8432348 [details] [diff] [review]
Fix

Review of attachment 8432348 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good to me.  We had similar bugs in nsCSPContext.cpp, but fixed those before landing.  Must've missed these... luckily nsCSPParser.cpp is not active code unless you set a pref (it's not enabled yet).

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

Looked at all the CSP code we landed. cspUtils and cspContext are fine. The proposed patch (dis)covers all the problems where that problem occurs.

Comment 4

[Makoto Kato [:m_kato]]

landed in m-i
https://hg.mozilla.org/integration/mozilla-inbound/rev/04dd691d5f59

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/04dd691d5f59

Comment 6

[Matt Wobensmith [:mwobensmith][:matt:]]

Marking qe-verify- due to lack of test case or STR. Please feel free to provide if you'd like this bug to be verified. Thank you.