Commit 1ac2cd9b authored by jst%mozilla.jstenback.com's avatar jst%mozilla.jstenback.com
Browse files

Fixing bug 328457. Accessing ambigous members on scriptable plugins from JS... 

Fixing bug 328457. Accessing ambigous members on scriptable plugins from JS can cause crashes. r=mrbkap@gmail.com, sr=brendan@mozilla.org
parent a538d4ae

modules/plugin/base/src/nsJSNPRuntime.cpp

+37 −10
Original line number Diff line number Diff line
@@ -129,6 +129,10 @@ JS_STATIC_DLL_CALLBACK(JSBool) 
NPObjWrapper_Call(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,

                  jsval *rval);



static bool

CreateNPObjectMember(NPP npp, JSContext *cx, JSObject *obj,

                     NPObject *npobj, jsval id, jsval *vp);



static JSClass sNPObjectJSWrapperClass =

  {

    "NPObject JS wrapper class", JSCLASS_HAS_PRIVATE | JSCLASS_NEW_RESOLVE,
@@ -140,7 +144,7 @@ static JSClass sNPObjectJSWrapperClass = 
  };



typedef struct NPObjectMemberPrivate {

    NPObject* npobj;

    JSObject *npobjWrapper;

    jsval fieldValue;

    jsval methodName;

    NPP   npp;
@@ -1521,6 +1525,10 @@ CreateNPObjectMember(NPP npp, JSContext *cx, JSObject *obj, 
  if (!memberPrivate)

    return false;



  // Make sure to clear all members in case something fails here

  // during initialization.

  memset(memberPrivate, 0, sizeof(NPObjectMemberPrivate));



  JSObject *memobj = ::JS_NewObject(cx, &sNPObjectMemberClass, nsnull, nsnull);

  if (!memobj) {

    PR_Free(memberPrivate);
@@ -1542,8 +1550,14 @@ CreateNPObjectMember(NPP npp, JSContext *cx, JSObject *obj, 


  fieldValue = NPVariantToJSVal(npp, cx, &npv);



  memberPrivate->npobj = npobj;

  _retainobject(npobj);

  // npobjWrapper is the JSObject through which we make sure we don't

  // outlive the underlying NPObject, so make sure it points to the

  // real JSObject wrapper for the NPObject.

  while (JS_GET_CLASS(cx, obj) != &sNPObjectJSWrapperClass) {

    obj = ::JS_GetPrototype(cx, obj);

  }



  memberPrivate->npobjWrapper = obj;



  memberPrivate->fieldValue = fieldValue;

  memberPrivate->methodName = id;
@@ -1589,7 +1603,6 @@ NPObjectMember_Finalize(JSContext *cx, JSObject *obj) 
  if (!memberPrivate)

    return;



  _releaseobject(memberPrivate->npobj);

  PR_Free(memberPrivate);

}
@@ -1603,9 +1616,16 @@ NPObjectMember_Call(JSContext *cx, JSObject *obj, 
  NPObjectMemberPrivate *memberPrivate =

    (NPObjectMemberPrivate *)::JS_GetInstancePrivate(cx, memobj,

                                                     &sNPObjectMemberClass,

                                                     nsnull);

  if (!memberPrivate || !memberPrivate->npobj)

                                                     argv);

  if (!memberPrivate || !memberPrivate->npobjWrapper)

    return JS_FALSE;



  NPObject *npobj = GetNPObject(cx, memberPrivate->npobjWrapper);

  if (!npobj) {

    ThrowJSException(cx, "Call on invalid member object");



    return JS_FALSE;

  }



  NPVariant npargs_buf[8];

  NPVariant *npargs = npargs_buf;
@@ -1638,8 +1658,7 @@ NPObjectMember_Call(JSContext *cx, JSObject *obj, 
  

  NPVariant npv;

  JSBool ok;

  ok = memberPrivate->npobj->_class->invoke(memberPrivate->npobj,

                                            (NPIdentifier)memberPrivate->methodName,

  ok = npobj->_class->invoke(npobj, (NPIdentifier)memberPrivate->methodName,

                             npargs, argc, &npv);



  // Release arguments.
@@ -1680,5 +1699,13 @@ NPObjectMember_Mark(JSContext *cx, JSObject *obj, void *arg) 
                     "NPObject Member => fieldValue", arg);

  }



  // There's no strong reference from our private data to the

  // NPObject, so make sure to mark the NPObject wrapper to keep the

  // NPObject alive as long as this NPObjectMember is alive.

  if (memberPrivate->npobjWrapper) {

    ::JS_MarkGCThing(cx, memberPrivate->npobjWrapper,

                     "NPObject Member => npobjWrapper", arg);

  }



  return 0;

}

modules/plugin/base/src/nsJSNPRuntime.h

+0 −3
Original line number Diff line number Diff line
@@ -102,8 +102,5 @@ public: 
bool

JSValToNPVariant(NPP npp, JSContext *cx, jsval val, NPVariant *variant);



bool

CreateNPObjectMember(NPP npp, JSContext *cx, JSObject *obj,

                     NPObject *npobj, jsval id, jsval *vp);



#endif // nsJSNPRuntime_h__