From 2f4742e523fe7bab0439327d045908c0df938488 Mon Sep 17 00:00:00 2001 From: Cameron Kaiser Date: Mon, 31 Jul 2017 21:13:38 -0700 Subject: [PATCH] #416: M1383000 M1376459 M1372467 M1372383 M1383002 --- .../webrtc/signaling/src/sdp/sipcc/sdp_attr.c | 10 ++- modules/libjar/nsJAR.cpp | 8 +-- netwerk/mime/nsMIMEHeaderParamImpl.cpp | 4 +- netwerk/protocol/http/nsHttpChannel.cpp | 70 +++++++++++++++++++ 4 files changed, 85 insertions(+), 7 deletions(-) diff --git a/media/webrtc/signaling/src/sdp/sipcc/sdp_attr.c b/media/webrtc/signaling/src/sdp/sipcc/sdp_attr.c index 577cb6377..3342b808f 100644 --- a/media/webrtc/signaling/src/sdp/sipcc/sdp_attr.c +++ b/media/webrtc/signaling/src/sdp/sipcc/sdp_attr.c @@ -1528,6 +1528,9 @@ sdp_result_e sdp_parse_attr_fmtp (sdp_t *sdp_p, sdp_attr_t *attr_p, temp=PL_strtok_r(NULL, ",", &strtok_state); iter++; } + } else { + SDP_FREE(temp_ptr); + return SDP_INVALID_PARAMETER; } fmtp_p->fmtp_format = SDP_FMTP_CODEC_INFO; @@ -1771,7 +1774,12 @@ sdp_result_e sdp_parse_attr_fmtp (sdp_t *sdp_p, sdp_attr_t *attr_p, } } } - fmtp_ptr++; + if (*fmtp_ptr == '\n') { + // reached end of line, stop parsing + done = TRUE; + } else { + fmtp_ptr++; + } } else { done = TRUE; } diff --git a/modules/libjar/nsJAR.cpp b/modules/libjar/nsJAR.cpp index 04ecc5e51..de1fe99a4 100644 --- a/modules/libjar/nsJAR.cpp +++ b/modules/libjar/nsJAR.cpp @@ -318,10 +318,10 @@ nsJAR::GetInputStreamWithSpec(const nsACString& aJarDirSpec, // Watch out for the jar:foo.zip!/ (aDir is empty) top-level special case! nsZipItem *item = nullptr; - const char *entry = PromiseFlatCString(aEntryName).get(); - if (*entry) { + const nsCString& entry = PromiseFlatCString(aEntryName); + if (*entry.get()) { // First check if item exists in jar - item = mZip->GetItem(entry); + item = mZip->GetItem(entry.get()); if (!item) return NS_ERROR_FILE_TARGET_DOES_NOT_EXIST; } nsJARInputStream* jis = new nsJARInputStream(); @@ -330,7 +330,7 @@ nsJAR::GetInputStreamWithSpec(const nsACString& aJarDirSpec, nsresult rv = NS_OK; if (!item || item->IsDirectory()) { - rv = jis->InitDirectory(this, aJarDirSpec, entry); + rv = jis->InitDirectory(this, aJarDirSpec, entry.get()); } else { rv = jis->InitFile(this, item); } diff --git a/netwerk/mime/nsMIMEHeaderParamImpl.cpp b/netwerk/mime/nsMIMEHeaderParamImpl.cpp index 2c42afa48..a23d9e907 100644 --- a/netwerk/mime/nsMIMEHeaderParamImpl.cpp +++ b/netwerk/mime/nsMIMEHeaderParamImpl.cpp @@ -824,8 +824,8 @@ nsMIMEHeaderParamImpl::DecodeRFC5987Param(const nsACString& aParamVal, nsAutoCString value; uint32_t delimiters = 0; - const char *encoded = PromiseFlatCString(aParamVal).get(); - const char *c = encoded; + const nsCString& encoded = PromiseFlatCString(aParamVal); + const char *c = encoded.get(); while (*c) { char tc = *c++; diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp index 32e4fcd0d..0edaf1efb 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp @@ -90,6 +90,7 @@ #include "nsIDeprecationWarner.h" #include "nsIDocument.h" #include "nsICompressConvStats.h" +#include "mozilla/unused.h" namespace mozilla { namespace net { @@ -161,6 +162,58 @@ Hash(const char *buf, nsACString &hash) return NS_OK; } +bool +IsInSubpathOfAppCacheManifest(nsIApplicationCache *cache, nsACString const& uriSpec) +{ + MOZ_ASSERT(cache); + + static bool sForbid = true; + static nsresult once = Preferences::AddBoolVarCache(&sForbid, "network.appcache.forbid-fallback-outside-manifest-path", true); + Unused << once; + + if (!sForbid) { + return true; + } + + nsresult rv; + + nsCOMPtr uri; + rv = NS_NewURI(getter_AddRefs(uri), uriSpec); + if (NS_FAILED(rv)) { + return false; + } + + nsCOMPtr url(do_QueryInterface(uri, &rv)); + if (NS_FAILED(rv)) { + return false; + } + + nsAutoCString directory; + rv = url->GetDirectory(directory); + if (NS_FAILED(rv)) { + return false; + } + + nsCOMPtr manifestURI; + rv = cache->GetManifestURI(getter_AddRefs(manifestURI)); + if (NS_FAILED(rv)) { + return false; + } + + nsCOMPtr manifestURL(do_QueryInterface(manifestURI, &rv)); + if (NS_FAILED(rv)) { + return false; + } + + nsAutoCString manifestDirectory; + rv = manifestURL->GetDirectory(manifestDirectory); + if (NS_FAILED(rv)) { + return false; + } + + return StringBeginsWith(directory, manifestDirectory); +} + } // unnamed namespace // We only treat 3xx responses as redirects if they have a Location header and @@ -2753,6 +2806,12 @@ nsHttpChannel::ProcessFallback(bool *waitingForRedirectCallback) return NS_OK; } + if (!IsInSubpathOfAppCacheManifest(mApplicationCache, mFallbackKey)) { + // Refuse to fallback if the fallback key is not contained in the same + // path as the cache manifest. + return NS_OK; + } + MOZ_ASSERT(fallbackEntryType & nsIApplicationCache::ITEM_FALLBACK, "Fallback entry not marked correctly!"); @@ -3676,6 +3735,17 @@ nsHttpChannel::OnOfflineCacheEntryAvailable(nsICacheEntry *aEntry, if (namespaceType & nsIApplicationCacheNamespace::NAMESPACE_FALLBACK) { + + nsAutoCString namespaceSpec; + rv = namespaceEntry->GetNamespaceSpec(namespaceSpec); + NS_ENSURE_SUCCESS(rv, rv); + + // This prevents fallback attacks injected by an insecure subdirectory + // for the whole origin (or a parent directory). + if (!IsInSubpathOfAppCacheManifest(mApplicationCache, namespaceSpec)) { + return NS_OK; + } + rv = namespaceEntry->GetData(mFallbackKey); NS_ENSURE_SUCCESS(rv, rv); }