Commit 7e05aad3 authored by valenting's avatar valenting
Browse files

Bug 1812038 - Avoid OOM with corrupt JAR archive r=necko-reviewers,kershaw 

Differential Revision: https://phabricator.services.mozilla.com/D176907
parent 4bb66750

modules/libjar/nsJARInputStream.cpp

+8 −1
Original line number Diff line number Diff line
@@ -9,6 +9,7 @@ 
#include "zipstruct.h"  // defines ZIP compression codes

#include "nsZipArchive.h"

#include "mozilla/MmapFaultHandler.h"

#include "mozilla/StaticPrefs_network.h"

#include "mozilla/UniquePtr.h"

#include "mozilla/UniquePtrExtensions.h"
@@ -154,6 +155,8 @@ nsJARInputStream::Available(uint64_t* _retval) { 
  // They just use the _retval value.

  *_retval = 0;



  uint64_t maxAvailableSize = 0;



  switch (mMode) {

    case MODE_NOTINITED:

      break;
@@ -167,7 +170,11 @@ nsJARInputStream::Available(uint64_t* _retval) { 


    case MODE_INFLATE:

    case MODE_COPY:

      *_retval = mOutSize - mZs.total_out;

      maxAvailableSize = StaticPrefs::network_jar_max_available_size();

      if (!maxAvailableSize) {

        maxAvailableSize = std::numeric_limits<uint64_t>::max();

      }

      *_retval = std::min(mOutSize - mZs.total_out, maxAvailableSize);

      break;

  }

modules/libpref/init/StaticPrefList.yaml

+7 −0
Original line number Diff line number Diff line
@@ -12585,6 +12585,13 @@ 
  value: @IS_EARLY_BETA_OR_EARLIER@

  mirror: always



# nsJARInputStream::Available returns the size indicated by the archived entry

# so we need a limit so we don't OOM if the archive is corrupted.

- name: network.jar.max_available_size

  type: RelaxedAtomicUint32

  value: 256*1024*1024 # 256 Mb

  mirror: always



# When this pref is true we clear the Content-Encoding header for

# application/x-gzip Content-Type responses, see bug 1030660.

#