Closed
Bug 1195272
Opened 11 years ago
Closed 10 years ago
dead pointer used as hashtable key in PluginModuleChild::DeallocNPObject
Categories
(Core Graveyard :: Plug-ins, defect)
Core Graveyard
Plug-ins
Tracking
(Not tracked)
RESOLVED
DUPLICATE
of bug 620243
People
(Reporter: Ms2ger, Unassigned)
Details
It frees aNPObj, and then calls PluginScriptableObjectChild::GetActorForNPObject(aNPObj).
(Found by scan-build.)
|
||
Comment 1•11 years ago
|
||
Can this actually be triggered in practice? If so calling sec-high, but it seems like that would never work and we would have runtime evidence of this bug.
Keywords: csectype-uaf,
sec-high
|
||
Comment 2•11 years ago
|
||
This code is pretty sketchy and should be improved, but as far as I can see we don't actually dereference the dead pointer so there's no security issue.
Group: core-security
Keywords: sec-high
|
|
||
Updated•11 years ago
|
Keywords: csectype-uaf
Summary: UAF in PluginModuleChild::DeallocNPObject → dead pointer used as hashtable key in PluginModuleChild::DeallocNPObject
|
||
Comment 3•10 years ago
|
||
Looks like a duplicate of the older bug 620243.
|
|
||
Updated•10 years ago
|
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → DUPLICATE
|
||
Updated•4 years ago
|
Product: Core → Core Graveyard
You need to log in
before you can comment on or make changes to this bug.
Description
•