Closed Bug 824220 Opened 7 years ago Closed 7 years ago

Constraints should be passed from calling thread to SIPCC thread using a pointer

Categories

(Core :: WebRTC: Signaling, defect, P1, critical)

defect

Tracking

()

RESOLVED FIXED
mozilla20
Tracking Status
firefox19 --- disabled
firefox20 --- fixed
firefox-esr17 --- unaffected
b2g18 --- disabled

People

(Reporter: abr, Assigned: abr)

Details

(Keywords: sec-audit, sec-moderate, Whiteboard: [WebRTC][blocking-webrtc+][qa-][adv-main20-])

Attachments

(1 file, 1 obsolete file)

Currently, the cc_invokeFeatureSDPMode function in cc_call_feature.c generates a random number as an index into a global hash table for storing offer and answer constraints. This isn't the most architecturally sound way of handling data passing. This bug is a memento to clean up this handling so that a pointer is passed directly via the callFeature.featData.ccData structure rather than indirectly by way of the hash table.
This hash table can be accessed from two threads in a non-safe manner, per abr:

	abr	(The problem is that the hashtable is not synchronized, and it's being modified by two different threads)
	abr	I'm not clear about whether this is the kind of issue that we should mark a bug as security sensitive for. But as long as it's in the open, I'm hesitant to add any comments about the potential for crashes.
	abr	It should, in any case, be an easy fix, and it might stave off some of the fuzzer-generated bugs that appear to be popping up with some rapdity.
Group: core-security
Severity: normal → critical
Priority: -- → P1
Whiteboard: [WebRTC] → [WebRTC][blocking-webrtc+]
Status: NEW → ASSIGNED
Attachment #696113 - Attachment is obsolete: true
Attachment #696115 - Flags: review?(rjesup)
Attachment #696115 - Flags: review?(rjesup) → review+
Attachment #696115 - Flags: checkin?(rjesup)
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Attachment #696115 - Flags: checkin?(rjesup) → checkin+
Whiteboard: [WebRTC][blocking-webrtc+] → [WebRTC][blocking-webrtc+][qa-]
Whiteboard: [WebRTC][blocking-webrtc+][qa-] → [WebRTC][blocking-webrtc+][qa-][adv-main20-]
Group: core-security
You need to log in before you can comment on or make changes to this bug.