corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 1465860 - Don't crash in JS IPC on invalid object id. r=evilpie

Browse Source 
Instead, return an error up to the caller, who can return an IPC error, which
will kill the child. This is significantly friendlier to fuzzing.

MozReview-Commit-ID: C67xSqUeN1i
This commit is contained in:
Alex Gaynor
2018-05-31 16:29:03 -04:00
parent 7efdf70e65
commit 687ce91a32
4 changed files with 69 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
js/ipc/JavaScriptShared.h
View File

@@ -29,7 +29,7 @@ class ObjectId {
explicit ObjectId(uint64_t serialNumber, bool hasXrayWaiver)
: serialNumber_(serialNumber), hasXrayWaiver_(hasXrayWaiver)
{
if (MOZ_UNLIKELY(serialNumber == 0 || serialNumber > SERIAL_NUMBER_MAX))
if (isInvalidSerialNumber(serialNumber))
MOZ_CRASH("Bad CPOW Id");
}
@@ -49,8 +49,11 @@ class ObjectId {
}
static ObjectId nullId() { return ObjectId(); }
static ObjectId deserialize(uint64_t data) {
return ObjectId(data >> FLAG_BITS, data & 1);
static Maybe<ObjectId> deserialize(uint64_t data) {
if (isInvalidSerialNumber(data >> FLAG_BITS)) {
return Nothing();
}
return Some(ObjectId(data >> FLAG_BITS, data & 1));
}
// For use with StructGCPolicy.
@@ -60,6 +63,10 @@ class ObjectId {
private:
ObjectId() : serialNumber_(0), hasXrayWaiver_(false) {}
static bool isInvalidSerialNumber(uint64_t aSerialNumber) {
return aSerialNumber == 0 || aSerialNumber > SERIAL_NUMBER_MAX;
}
uint64_t serialNumber_ : SERIAL_NUMBER_BITS;
bool hasXrayWaiver_ : 1;
};