incorrect struct size check in libnptest.so can cause overrun

RESOLVED FIXED in mozilla6

Status

()

Core
Plug-ins
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: martin, Assigned: martin)

Tracking

unspecified
mozilla6
x86_64
Linux
Points:
---
Bug Flags:
in-testsuite ?

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

6 years ago
User-Agent:       Opera/9.80 (X11; Linux x86_64; U; en) Presto/2.8.131 Version/11.10
Build Identifier: 

To joshmoz / dwitte;

When you added clearsitedata and urlredirectnotify, you forgot to update the struct size check in fillPluginFunctionTable() so now libnptest.so overwrites memory when loaded in browsers that don't support these funcs yet.

Look at the attached patch.

Reproducible: Always
(Assignee)

Comment 1

6 years ago
Created attachment 529086 [details] [diff] [review]
fixes the struct size check in libnptest.so
Attachment #529086 - Flags: review?(joshmoz)

Updated

6 years ago
Attachment #529086 - Flags: review?(joshmoz) → review+
Assignee: nobody → mnemo
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true
Keywords: checkin-needed
http://hg.mozilla.org/projects/cedar/rev/a2db30268958
Keywords: checkin-needed
Whiteboard: [fixed-in-cedar]
http://hg.mozilla.org/mozilla-central/rev/c8c3e140ebe3

Martin, thanks for the patch!

Do we need to backport this to any branches?
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
Whiteboard: [fixed-in-cedar]
Target Milestone: --- → mozilla6
Er, the right m-c changset is http://hg.mozilla.org/mozilla-central/rev/a2db30268958
You need to log in before you can comment on or make changes to this bug.