Mercurial > hg > release > icedtea-web-1.2
changeset 369:f6cdd8639a8d
Fixes PR1106, buffer overflow in plugin table
| author | Adam Domurad <adomurad@redhat.com> |
|---|---|
| date | Tue, 07 Aug 2012 10:59:11 -0400 |
| parents | a0ac102c8ed5 |
| children | 596a718be03f |
| files | ChangeLog NEWS plugin/icedteanp/IcedTeaNPPlugin.cc |
| diffstat | 3 files changed, 15 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/ChangeLog Thu Aug 02 09:11:37 2012 -0400 +++ b/ChangeLog Tue Aug 07 10:59:11 2012 -0400 @@ -1,3 +1,10 @@ +2012-08-07 Adam Domurad <adomurad@redhat.com> + + Fixes PR1106, plugin crashing with firefox + archlinux/gentoo + * plugin/icedteanp/IcedTeaNPPlugin.cc + (initialize_browser_functions): Account for the fact that + browserTable->size can be larger than sizeof(NPNetscapeFuncs) + 2012-08-02 Adam Domurad <adomurad@redhat.com> * plugin/icedteanp/IcedTeaPluginUtils.cc: Fixed a typo that prevented
--- a/NEWS Thu Aug 02 09:11:37 2012 -0400 +++ b/NEWS Tue Aug 07 10:59:11 2012 -0400 @@ -9,6 +9,8 @@ CVE-XXXX-YYYY: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY New in release 1.2.2 (2012-XX-XX): +* Plugin + - PR1106: Buffer overflow in plugin table New in release 1.2.1 (2012-07-31): * Security Updates
--- a/plugin/icedteanp/IcedTeaNPPlugin.cc Thu Aug 02 09:11:37 2012 -0400 +++ b/plugin/icedteanp/IcedTeaNPPlugin.cc Tue Aug 07 10:59:11 2012 -0400 @@ -2053,8 +2053,13 @@ //Ensure any unused fields are NULL memset(&browser_functions, 0, sizeof(NPNetscapeFuncs)); + + //browserTable->size can be larger than sizeof(NPNetscapeFuncs) (PR1106) + size_t copySize = browserTable->size < sizeof(NPNetscapeFuncs) ? + browserTable->size : sizeof(NPNetscapeFuncs); + //Copy fields according to given size - memcpy(&browser_functions, browserTable, browserTable->size); + memcpy(&browser_functions, browserTable, copySize); return true; }