823369 - mozilla::widget::EventFlags assumes its size is less than uint32_t

Status: RESOLVED FIXED

(Core :: Widget, defect)

Description

[Ben Turner (not reading bugmail, use the needinfo flag!)]

This code will corrupt the stack if the size of the EventFlags struct ever grows beyond a uint32_t.

571   inline uint32_t GetRawFlags() const
572   {
573     uint32_t result = 0;
574     memcpy(&result, this, sizeof(EventFlags));
575     return result;
576   }

Comment 1

[Masatoshi Kimura [:emk]]

MOZ_STATIC_ASSERT(sizeof(mozilla::widget::EventFlags) <= sizeof(uint32_t)); would be enough at the moment.

Comment 2

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 5/2-5/10)]

Attachment: Patch

with this patch:
https://tbpl.mozilla.org/?tree=Try&usebuildbot=1&rev=371f294f50f3

should fail:
https://tbpl.mozilla.org/?tree=Try&usebuildbot=1&rev=d0d851c0ce93

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 5/2-5/10)]

Attachment: Patch

https://tbpl.mozilla.org/?tree=Try&usebuildbot=1&rev=381039d39f40
https://tbpl.mozilla.org/?tree=Try&usebuildbot=1&rev=57bde456e824

Comment 4

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 5/2-5/10)]

Attachment: Patch

oops.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 694799 [details] [diff] [review]
Patch

"mozilla::widget::EventFlags must not be bigger than the RawFlags"
that should take care of the = part of the comparison.

Comment 6

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 5/2-5/10)]

Thanks!
https://hg.mozilla.org/integration/mozilla-inbound/rev/e797fe5eb621

Comment 7

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

https://hg.mozilla.org/mozilla-central/rev/e797fe5eb621