libproxy rebuild

2021-02-25 23:48:13 +03:00
parent 6c10c15a93
commit 67f4d2409e
6 changed files with 403 additions and 0 deletions
@@ -0,0 +1,38 @@
+From 738785214546ec5bb772886019529b2a6519deaf Mon Sep 17 00:00:00 2001
+From: Simon McVittie <smcv@debian.org>
+Date: Fri, 1 May 2020 19:04:22 +0100
+Subject: [PATCH] mozjs: Avoid use-after-free
+
+If we don't assign the temporary std::string returned by
+url_.to_string() to a variable, then it immediately goes out of scope
+and is freed, resulting in the result of c_str() pointing into freed
+memory. This works about as well as you would expect.
+
+Signed-off-by: Simon McVittie <smcv@debian.org>
+---
+ libproxy/modules/pacrunner_mozjs.cpp | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/libproxy/modules/pacrunner_mozjs.cpp b/libproxy/modules/pacrunner_mozjs.cpp
+index ade6d0a..aac6531 100644
+--- a/libproxy/modules/pacrunner_mozjs.cpp
+++ b/libproxy/modules/pacrunner_mozjs.cpp
+@@ -175,14 +175,11 @@ class mozjs_pacrunner : public pacrunner {
+ 
+ 	string run(const url& url_) throw (bad_alloc) {
+ 		// Build arguments to the FindProxyForURL() function
+-		const char *tmpurl  = url_.to_string().c_str();
+-		const char *tmphost = url_.get_host().c_str();
+-		if (!tmpurl || !tmphost) {
+-			throw bad_alloc();
+-		}
+		string tmpurl(url_.to_string());
+		string tmphost(url_.get_host());
+ 		JS::AutoValueArray<2> args(this->jsctx);
+-		args[0].setString(JS_NewStringCopyZ(this->jsctx, tmpurl));
+-		args[1].setString(JS_NewStringCopyZ(this->jsctx, tmphost));
+		args[0].setString(JS_NewStringCopyZ(this->jsctx, tmpurl.c_str()));
+		args[1].setString(JS_NewStringCopyZ(this->jsctx, tmphost.c_str()));
+ 
+ 		// Find the proxy (call FindProxyForURL())
+ 		JS::RootedValue rval(this->jsctx);