663893 - Unsafe uses of mListener in nsWebSocketHandler.cpp

Status: RESOLVED FIXED

(Core :: Networking: WebSockets, defect)

Description

[Josh Matthews [:jdm]]

Both of the following are not sheltered in |if (mListener)| blocks, unlike other similar constructs:

868 nsCOMPtr<nsIRunnable> event =
869   new CallOnServerClose(mListener, mContext);
870 NS_DispatchToMainThread(event);

1317 nsCOMPtr<nsIRunnable> event =
1318   new CallOnStop(mListener, mContext, reason);
1319 NS_DispatchToMainThread(event);

Comment 1

[Josh Matthews [:jdm]]

Attachment: Avoid null dereferences in websocket handler.

Comment 2

[Patrick McManus [:mcmanus]]

Comment on attachment 538965 [details] [diff] [review]
Avoid null dereferences in websocket handler.

Review of attachment 538965 [details] [diff] [review]:
-----------------------------------------------------------------

Comment 3

[Dão Gottwald [:dao]]

http://hg.mozilla.org/mozilla-central/rev/0715dd3bbfb8

Comment 4

[(no longer active)]

The push broke the build, so I backed out all of its changesets.

Comment 5

[(no longer active)]

Landed on inbound.

Comment 6

[Dão Gottwald [:dao]]

http://hg.mozilla.org/mozilla-central/rev/09428adfd4a8

Comment 7

[Josh Matthews [:jdm]]

Comment on attachment 538965 [details] [diff] [review]
Avoid null dereferences in websocket handler.

This fixes a potential crasher if websockets are misused by a page.

Comment 8

[Patrick McManus [:mcmanus]]

(In reply to comment #7)
> Comment on attachment 538965 [details] [diff] [review] [review]
> Avoid null dereferences in websocket handler.
> 
> This fixes a potential crasher if websockets are misused by a page.

Can a page trigger this? I would think it would be limited to (broken) chrome code.. that's why I didn't a?

Comment 9

[Josh Matthews [:jdm]]

We were seeing this in Fennec nightlies on mibbit.com.

Comment 10

[Mark Finkle (:mfinkle) (use needinfo?)]

Simple fix that fixes a mibbit crash in Fennec. Baked on trunk for 3 days

Comment 11

[LegNeato]

Comment on attachment 538965 [details] [diff] [review]
Avoid null dereferences in websocket handler.

Approved for mozilla-aurora

Comment 12

[Patrick McManus [:mcmanus]]

http://hg.mozilla.org/releases/mozilla-aurora/rev/3b8fa026b986