#402, #395: remaining sec patches, update blacklist

104fx_upcerts.sh

@@ -0,0 +1,11 @@
+#!/bin/csh -f
+
+if (! -e security/manager/ssl/nsSTSPreloadList.inc) then
+	echo 'not in the tenfourfox folder, aborting'
+endif
+
+set verbose
+cp ../esr52/security/nss/lib/ckfw/builtins/certdata.txt security/nss/lib/ckfw/builtins/certdata.txt
+cp ../esr52/security/manager/ssl/StaticHPKPins.h security/manager/ssl/StaticHPKPins.h
+perl ./104fx_import_esr52_stspreload.pl > security/manager/ssl/nsSTSPreloadList.inc
+

dom/indexedDB/ActorsParent.cpp

@@ -19381,12 +19381,18 @@ FactoryOp::FinishSendResults()
   RefPtr<Factory> factory;
   mFactory.swap(factory);
 
+  // It can happen that this FactoryOp is only held alive by the gFactoryOps.
+  RefPtr<FactoryOp> kungFuDeathGrip;
+
   if (mBlockedDatabaseOpen) {
     if (mDelayedOp) {
       MOZ_ALWAYS_TRUE(NS_SUCCEEDED(NS_DispatchToCurrentThread(mDelayedOp)));
       mDelayedOp = nullptr;
     }
 
+    // Add a self reference before removing ourself from the array.
+    kungFuDeathGrip = this;
+
     MOZ_ASSERT(gFactoryOps);
     gFactoryOps->RemoveElement(this);
   }

dom/media/encoder/TrackEncoder.cpp

@@ -127,10 +127,12 @@ AudioTrackEncoder::InterleaveTrackData(AudioChunk& aChunk,
                                        uint32_t aOutputChannels,
                                        AudioDataValue* aOutput)
 {
+  uint32_t numChannelsToCopy = std::min(aOutputChannels,
+                                        static_cast<uint32_t>(aChunk.mChannelData.Length()));
   switch(aChunk.mBufferFormat) {
     case AUDIO_FORMAT_S16: {
       nsAutoTArray<const int16_t*, 2> array;
-      array.SetLength(aOutputChannels);
+      array.SetLength(numChannelsToCopy);
       for (uint32_t i = 0; i < array.Length(); i++) {
         array[i] = static_cast<const int16_t*>(aChunk.mChannelData[i]);
       }
@@ -139,7 +141,7 @@ AudioTrackEncoder::InterleaveTrackData(AudioChunk& aChunk,
     }
     case AUDIO_FORMAT_FLOAT32: {
       nsAutoTArray<const float*, 2> array;
-      array.SetLength(aOutputChannels);
+      array.SetLength(numChannelsToCopy);
       for (uint32_t i = 0; i < array.Length(); i++) {
         array[i] = static_cast<const float*>(aChunk.mChannelData[i]);
       }

gfx/thebes/gfxPlatformMac.cpp

@@ -262,6 +262,8 @@ gfxPlatformMac::IsFontFormatSupported(nsIURI *aFontURI, uint32_t aFormatFlags)
 	spec.Equals("https://www.apple.com/wss/fonts/SF-Pro-Display/v1/sf-pro-display_regular.ttf") ||
 	spec.Equals("https://www.apple.com/wss/fonts/SF-Pro-Display/v1/sf-pro-display_light.woff") ||
 	spec.Equals("https://www.apple.com/wss/fonts/SF-Pro-Display/v1/sf-pro-display_light.ttf") ||
+	spec.Equals("https://www.apple.com/wss/fonts/SF-Pro-Display/v1/sf-pro-display_semibold.woff") ||
+	spec.Equals("https://www.apple.com/wss/fonts/SF-Pro-Display/v1/sf-pro-display_semibold.ttf") ||
 	spec.Equals("http://www.apple.com/wss/fonts/SF-Pro-Text/v1/sf-pro-text_bold.woff") ||
 	spec.Equals("http://www.apple.com/wss/fonts/SF-Pro-Text/v1/sf-pro-text_bold.ttf") ||
 	spec.Equals("http://www.apple.com/wss/fonts/SF-Pro-Text/v1/sf-pro-text_medium.woff") ||
@@ -278,6 +280,8 @@ gfxPlatformMac::IsFontFormatSupported(nsIURI *aFontURI, uint32_t aFormatFlags)
 	spec.Equals("http://www.apple.com/wss/fonts/SF-Pro-Display/v1/sf-pro-display_regular.ttf") ||
 	spec.Equals("http://www.apple.com/wss/fonts/SF-Pro-Display/v1/sf-pro-display_light.woff") ||
 	spec.Equals("http://www.apple.com/wss/fonts/SF-Pro-Display/v1/sf-pro-display_light.ttf") ||
+	spec.Equals("http://www.apple.com/wss/fonts/SF-Pro-Display/v1/sf-pro-display_semibold.woff") ||
+	spec.Equals("http://www.apple.com/wss/fonts/SF-Pro-Display/v1/sf-pro-display_semibold.ttf") ||
 	0) {
 	if (NS_SUCCEEDED(rv)) // Don't print if we couldn't get the URL.
 	fprintf(stderr,

security/manager/ssl/StaticHPKPins.h

@@ -1176,4 +1176,4 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = {
 
 static const int32_t kUnknownId = -1;
 
-static const PRTime kPreloadPKPinsExpirationTime = INT64_C(1504365060328000);
+static const PRTime kPreloadPKPinsExpirationTime = INT64_C(1506180744712000);