Closed Bug 1445590 Opened 6 years ago Closed 6 years ago

postMessage() with transfer crash

Categories

(Core :: DOM: Core & HTML, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla61
Tracking Status
firefox61 --- fixed

People

(Reporter: annevk, Assigned: baku)

References

Details

Attachments

(2 files)

I found this while working on tests for https://github.com/whatwg/html/pull/3557. I'd like to make the tests public since they are needed to move the specification forward, but I could probably leave the crashing bits out.

In particular the "assert_throws" lines in the third and fourth test seem to trigger this.
This blocks bug 1441141 but I'm not marking it as such since I'm not sure if the UI ends up exposing that publicly, which would be somewhat bad (although I guess I did discuss the postMessage() nature on IRC already...).
Assignee: nobody → amarchesini
Attachment #8958814 - Flags: review?(bugs)
Group: core-security → dom-core-security
Could you explain the issue a bit?
Flags: needinfo?(amarchesini)
(In reply to Olli Pettay [:smaug] from comment #3)
> Could you explain the issue a bit?

Sure. StructuredCloneHolder calls: https://searchfox.org/mozilla-central/source/dom/base/StructuredCloneHolder.cpp#1258
Where we assume that mData exists: https://searchfox.org/mozilla-central/source/dom/canvas/ImageBitmap.cpp#799
But if the image is closed, mData is null: https://searchfox.org/mozilla-central/source/dom/canvas/ImageBitmap.cpp#552

A closed image is detached: https://html.spec.whatwg.org/multipage/imagebitmap-and-animations.html#dom-imagebitmap-close
And a detached object cannot be transferred: https://html.spec.whatwg.org/multipage/structured-data.html#structuredserializewithtransfer

The fix checks if mData is null. If yes, it returns a null object in ToCloneData.
Flags: needinfo?(amarchesini)
This is just a nullptr crash. No sec-bug.
Group: dom-core-security
Attachment #8958814 - Flags: review?(bugs) → review+
Pushed by amarchesini@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/95ab98a246e6
ImageBitmap cannot be cloned/transferred if already closed, r=smaug
https://hg.mozilla.org/mozilla-central/rev/95ab98a246e6
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: