corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 1465860 - Don't crash in JS IPC on invalid object id. r=evilpie

Browse Source 
Instead, return an error up to the caller, who can return an IPC error, which
will kill the child. This is significantly friendlier to fuzzing.

MozReview-Commit-ID: C67xSqUeN1i
This commit is contained in:
Alex Gaynor
2018-05-31 16:29:03 -04:00
parent 7efdf70e65
commit 687ce91a32
4 changed files with 69 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
js/ipc/JavaScriptLogging.h
View File

@@ -168,10 +168,15 @@ class Logging
}
case JSVariant::TObjectVariant: {
const ObjectVariant& ovar = value.get_ObjectVariant();
if (ovar.type() == ObjectVariant::TLocalObject)
formatObject(incoming, true, ObjectId::deserialize(ovar.get_LocalObject().serializedId()), out);
else
formatObject(incoming, false, ObjectId::deserialize(ovar.get_RemoteObject().serializedId()), out);
if (ovar.type() == ObjectVariant::TLocalObject) {
Maybe<ObjectId> objId(ObjectId::deserialize(ovar.get_LocalObject().serializedId()));
MOZ_RELEASE_ASSERT(objId.isSome());
formatObject(incoming, true, objId.value(), out);
} else {
Maybe<ObjectId> objId(ObjectId::deserialize(ovar.get_RemoteObject().serializedId()));
MOZ_RELEASE_ASSERT(objId.isSome());
formatObject(incoming, false, objId.value(), out);
}
break;
}
case JSVariant::TSymbolVariant: {