486482 - null deref [@ nsPluginNativeWindowGtk2::CreateXEmbedWindow ]

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Martin Stránský [:stransky] (ni? me)]

Downstream bug https://bugzilla.redhat.com/show_bug.cgi?id=491477

There's a null deref in nsPluginNativeWindowGtk2::CreateXEmbedWindow()

(gdb) where
#0  0x0000003e9ec0efab in raise () from /lib64/libpthread.so.0
#1  0x0000003f4fa30f05 in nsProfileLock::FatalSignalHandler (signo=11)
    at nsProfileLock.cpp:212
#2  <signal handler called>
#3  nsPluginNativeWindowGtk2::CreateXEmbedWindow (this=0x2e283c0)
    at nsPluginNativeWindowGtk2.cpp:209
(gdb) list nsPluginNativeWindowGtk2.cpp:209
204   window = (nsPluginPort *)gtk_socket_get_id(GTK_SOCKET(mSocketWidget));
205 
206   // Fill out the ws_info structure.
207   // (The windowless case is done in nsObjectFrame.cpp.)
208   GdkWindow *gdkWindow = gdk_window_lookup((XID)window);
209   mWsInfo.display = GDK_WINDOW_XDISPLAY(gdkWindow);
210   mWsInfo.colormap =
GDK_COLORMAP_XCOLORMAP(gdk_drawable_get_colormap(gdkWindow));
211   GdkVisual* gdkVisual = gdk_drawable_get_visual(gdkWindow);
212   mWsInfo.visual = GDK_VISUAL_XVISUAL(gdkVisual);
213   mWsInfo.depth = gdkVisual->depth;
(gdb) select 3
(gdb) print window
$1 = (struct nsPluginPort *) 0x0
(gdb) print gdkWindow
$2 = <value optimized out>

window && gdkWindow are NULL so:

mWsInfo.display = GDK_WINDOW_XDISPLAY(gdkWindow);

produces a segfault.

It seems to affect all branches (1.9.0, 1.9.1 and Trunk).

Comment 1

[Martin Stránský [:stransky] (ni? me)]

Attachment: patch for 1.9.1

Comment 2

[Martin Stránský [:stransky] (ni? me)]

Comment on attachment 370613 [details] [diff] [review]
patch for 1.9.1

Can you please review this one?

Comment 3

[Josh Aas]

Comment on attachment 370613 [details] [diff] [review]
patch for 1.9.1

+    return(NS_ERROR_FAILURE);

Should just be "return NS_ERROR_FAILURE;", no parens.

Otherwise looks good.

Comment 4

[Martin Stránský [:stransky] (ni? me)]

Thanks!

Comment 5

[Dão Gottwald [:dao]]

http://hg.mozilla.org/mozilla-central/rev/f2a58ffcd00c

Comment 6

[Daniel Veditz [:dveditz]]

Comment on attachment 370613 [details] [diff] [review]
patch for 1.9.1

Approved for 1.9.1.4, a=dveditz for release-drivers

Comment 7

[Martin Stránský [:stransky] (ni? me)]

Oh sorry, seems to be already in. clearing the flag.

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 370613 [details] [diff] [review]
patch for 1.9.1

past code-freeze for 1.9.1.4, removing non-blocker approval.