Closed Bug 1378971 Opened 8 years ago Closed 4 years ago

Nascent undefined behavior in FromJSON_str_t()

Categories

(Core Graveyard :: Plug-ins, enhancement, P3)

Product:
Core Graveyard
Component:
Plug-ins
Type:
enhancement

Tracking

(Not tracked)

Status:
RESOLVED WONTFIX

People

(Reporter: q1, Unassigned)

Details

(Keywords: csectype-undefined, sec-moderate)

FromJSON_str_t() (browser\extensions\mortar\host\rpc.h) invokes undefined behavior by obtaining an iterator into the std::string object |tokenValue|, modifying the object using std::string::erase() and std::string::replace(), then incrementing the iterator and using the result to retrieve characters from the object. This usage violates C++11 s.21.4.1(6): References, pointers, and iterators referring to the elements of a basic_string sequence may be invalidated by the following uses of that basic_string object:... — Calling non-const member functions, except operator[], at, front, back, begin, rbegin, end, and rend. The bug appears to be nascent because it's in part of Project Mortar, which I believe has not yet been released.
Can you take a look at this to start, ywu?
Component: Untriaged → Plug-ins
Flags: needinfo?(ywu)
ok! thx for reporting this.
Flags: needinfo?(ywu)
Group: core-security → dom-core-security
Priority: -- → P3
Resolving as wont fix, plugin support deprecated in Firefox 85.
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → WONTFIX
Product: Core → Core Graveyard
Group: dom-core-security
You need to log in before you can comment on or make changes to this bug.