1615746 - Crash in [@ FramingChecker::CheckOneFrameOptionsPolicy]

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P1)

Description

[Nika Layzell [:nika] (ni? for response)]

This bug is for crash report bp-b1e1f4cf-ac16-43eb-9cc4-5ed550200214.

Top 10 frames of crashing thread:

0 libxul.so FramingChecker::CheckOneFrameOptionsPolicy dom/security/FramingChecker.cpp:164
1 libxul.so FramingChecker::CheckFrameOptions dom/security/FramingChecker.cpp:308
2 libxul.so DOMSecurityManager::Observe dom/security/DOMSecurityManager.cpp:107
3 libxul.so nsObserverList::NotifyObservers xpcom/ds/nsObserverList.cpp:65
4 libxul.so nsObserverService::NotifyObservers xpcom/ds/nsObserverService.cpp:292
5 libxul.so mozilla::net::nsHttpHandler::NotifyObservers netwerk/protocol/http/nsHttpHandler.cpp:823
6 libxul.so mozilla::net::nsHttpChannel::ProcessResponse netwerk/protocol/http/nsHttpChannel.cpp:2545
7 libxul.so mozilla::net::nsHttpChannel::OnStartRequest netwerk/protocol/http/nsHttpChannel.cpp:7864
8 libxul.so nsInputStreamPump::OnStateStart netwerk/base/nsInputStreamPump.cpp:504
9 libxul.so nsInputStreamPump::OnInputStreamReady netwerk/base/nsInputStreamPump.cpp:413

From a quick look, it appears as though the crashing line is https://searchfox.org/mozilla-central/rev/174f1195ec740e8f17223b48018f7e14e6d4e40e/dom/security/FramingChecker.cpp#164. The access to principal on this line is not null-checked, while other accesses to principal in the surrounding function are null-checked, so I expect this crash would be avoided by guarding the IsSameOrigin check.

I have Fission enabled.

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

Yeah, that's very likely - I'll fix that.

Comment 2

[Christoph Kerschbaumer [:ckerschb]]

Attachment: Bug 1615746: Fix crash in FramingChecker.cpp by adding a nullcheck on the principal. r=baku

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a89ae0203f38
Fix crash in FramingChecker.cpp by adding a nullcheck on the principal. r=baku

Comment 4

[Razvan Maries]

https://hg.mozilla.org/mozilla-central/rev/a89ae0203f38