1747514 - Crash in nsExpatDriver::WillBuildModel

Status: RESOLVED FIXED

(Core :: Security: RLBox, defect)

Description

[Bobby Holley (:bholley)]

See bug 1745239 comment 14.

Comment 1

[Bobby Holley (:bholley)]

Attachment: Bug 1747514 - Ensure the expat sandbox is large enough to hold the base URI.

Comment 2

[Bobby Holley (:bholley)]

Attachment: Bug 1747514 - Fix some pointer arithmetic issues in RLBox.

We were double-allocating in TransferBuffer, but that was canceling out
the fact that we were only half-copying.

Comment 3

[Bobby Holley (:bholley)]

Attachment: Bug 1747514 - Make RLBoxTransferBufferToSandbox properly fallible.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1fd2be5bdbf2
Fix some pointer arithmetic issues in RLBox. r=shravanrn
https://hg.mozilla.org/integration/autoland/rev/cd3ef51bafb9
Make RLBoxTransferBufferToSandbox properly fallible. r=shravanrn
https://hg.mozilla.org/integration/autoland/rev/95ced5795758
Ensure the expat sandbox is large enough to hold the base URI. r=shravanrn,deian

Comment 5

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/1fd2be5bdbf2
https://hg.mozilla.org/mozilla-central/rev/cd3ef51bafb9
https://hg.mozilla.org/mozilla-central/rev/95ced5795758

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:bholley, is this bug important enough to require an uplift?
If not please set status_beta to wontfix.

For more information, please visit auto_nag documentation.

Comment 7

[Bobby Holley (:bholley)]

Comment on attachment 9256763 [details]
Bug 1747514 - Ensure the expat sandbox is large enough to hold the base URI.

Beta/Release Uplift Approval Request

• User impact if declined: Crashes.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Patches are small, fix some clear and well-understood bugs.
• String changes made/needed:

Comment 8

[Dianna Smith [:diannaS]]

Comment on attachment 9256763 [details]
Bug 1747514 - Ensure the expat sandbox is large enough to hold the base URI.

Approved for 96.0b10

Comment 9

[Dianna Smith [:diannaS]]

Comment on attachment 9256795 [details]
Bug 1747514 - Make RLBoxTransferBufferToSandbox properly fallible.

Approved for 96.0b10

Comment 10

[Dianna Smith [:diannaS]]

https://hg.mozilla.org/releases/mozilla-beta/rev/731710bbc529
https://hg.mozilla.org/releases/mozilla-beta/rev/45bc7cbe3df7
https://hg.mozilla.org/releases/mozilla-beta/rev/e68bbeac2dae