Last Comment Bug 653718 - incorrect struct size check in libnptest.so can cause overrun
: incorrect struct size check in libnptest.so can cause overrun
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: Plug-ins (show other bugs)
: unspecified
: x86_64 Linux
: -- normal (vote)
: mozilla6
Assigned To: martin
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2011-04-29 06:50 PDT by martin
Modified: 2011-05-02 10:40 PDT (History)
5 users (show)
bzbarsky: in‑testsuite?
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
fixes the struct size check in libnptest.so (1.62 KB, patch)
2011-04-29 06:53 PDT, martin
jaas: review+
Details | Diff | Splinter Review

Description martin 2011-04-29 06:50:09 PDT
User-Agent:       Opera/9.80 (X11; Linux x86_64; U; en) Presto/2.8.131 Version/11.10
Build Identifier: 

To joshmoz / dwitte;

When you added clearsitedata and urlredirectnotify, you forgot to update the struct size check in fillPluginFunctionTable() so now libnptest.so overwrites memory when loaded in browsers that don't support these funcs yet.

Look at the attached patch.

Reproducible: Always
Comment 1 martin 2011-04-29 06:53:23 PDT
Created attachment 529086 [details] [diff] [review]
fixes the struct size check in libnptest.so
Comment 2 Boris Zbarsky [:bz] 2011-04-29 18:04:49 PDT
http://hg.mozilla.org/projects/cedar/rev/a2db30268958
Comment 3 Boris Zbarsky [:bz] 2011-05-02 10:39:34 PDT
http://hg.mozilla.org/mozilla-central/rev/c8c3e140ebe3

Martin, thanks for the patch!

Do we need to backport this to any branches?
Comment 4 Boris Zbarsky [:bz] 2011-05-02 10:40:24 PDT
Er, the right m-c changset is http://hg.mozilla.org/mozilla-central/rev/a2db30268958

Note You need to log in before you can comment on or make changes to this bug.