Closed Bug 1369545 Opened 8 years ago Closed 5 years ago

address potentially unsafe snprintf usage in PrepareAcceptLanguages

Categories

(Core :: Networking, enhancement, P2)

Product:
Core
Component:
Networking
Version:
45 Branch
Type:
enhancement

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1403802
Tracking Flags:
Tracking Status
firefox-esr45 --- wontfix
firefox-esr52 - wontfix
firefox53 - wontfix
firefox54 - wontfix
firefox55 - wontfix
firefox56 --- wontfix
firefox57 --- wontfix

People

(Reporter: keeler, Unassigned)

References

Details

(Keywords: sec-low, Whiteboard: [necko-triaged])

snprintf returns the number of bytes it *would have* written when it runs out of buffer space. PrepareAcceptLanguages uses the return value from snprintf without checking this. It looks like in practice this code can't overflow the buffer (and it comes from a user pref anyway (as opposed to content, which would be concerning), from what I can tell), but we should actually do the check and better future-proof this code.
Version: unspecified → 45 Branch
Track 53-/54- as we've build 54 RC and there is not security level here. Feel free to nominate again if the security level is critical/high.
tracking-firefox53: ? → -
tracking-firefox54: ? → -
tracking for 55.
tracking-firefox55: ? → +
Group: core-security → network-core-security
Keywords: sec-low
This is a sec-low that doesn't need to be tracked for 55. In 55, we are already tracking several sec-high/sec-crits. If there is a fix ready for this one and deemed low risk, please nominate for uplift to Beta.
status-firefox55: affected → fix-optional
tracking-firefox55: + → -
Potential sec bug that I don't want to backlog just that. PrepareAcceptLanguages is a candidate to rewrite with Tokenizer and an encapsulated string buffer (ns*CString), tho.
Whiteboard: [necko-next]
Priority: -- → P2
Whiteboard: [necko-next] → [necko-triaged]

This was fixed in bug 1403802 by rewriting the method in rust.

Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → DUPLICATE
Group: network-core-security
You need to log in before you can comment on or make changes to this bug.