From e901c0a71e44138d73bd4fad6d8b14204238229d Mon Sep 17 00:00:00 2001 From: Cameron Kaiser Date: Thu, 5 Mar 2020 19:02:20 -0800 Subject: [PATCH] #593: M1613943 M1613765 M1614971 --- dom/base/Navigator.cpp | 3 +-- media/libcubeb/src/cubeb_audiounit.c | 14 +++++++++++++- netwerk/sctp/src/netinet/sctp.h | 6 ++++-- netwerk/sctp/src/netinet/sctp_auth.c | 3 ++- netwerk/sctp/src/netinet/sctp_pcb.c | 5 ++++- netwerk/sctp/src/netinet/sctp_usrreq.c | 12 ++++++++++-- 6 files changed, 34 insertions(+), 9 deletions(-) diff --git a/dom/base/Navigator.cpp b/dom/base/Navigator.cpp index 150eafcfb..5dc294c54 100644 --- a/dom/base/Navigator.cpp +++ b/dom/base/Navigator.cpp @@ -1145,8 +1145,7 @@ BeaconStreamListener::OnStartRequest(nsIRequest *aRequest, // release the loadgroup first mLoadGroup = nullptr; - aRequest->Cancel(NS_ERROR_NET_INTERRUPT); - return NS_BINDING_ABORTED; + return NS_ERROR_ABORT; } NS_IMETHODIMP diff --git a/media/libcubeb/src/cubeb_audiounit.c b/media/libcubeb/src/cubeb_audiounit.c index b660b0648..253c17d66 100644 --- a/media/libcubeb/src/cubeb_audiounit.c +++ b/media/libcubeb/src/cubeb_audiounit.c @@ -5,6 +5,15 @@ * accompanying file LICENSE for details. */ #undef NDEBUG +#undef LOGGING_ENABLED + +#ifdef LOGGING_ENABLED +#define LOG(...) do { \ + fprintf(stderr, __VA_ARGS__); \ + } while(0) +#else +#define LOG(...) +#endif #include #include @@ -738,7 +747,10 @@ audiounit_stream_init(cubeb * context, cubeb_stream ** stream, char const * stre static void audiounit_stream_destroy(cubeb_stream * stm) { - int r; + int r = audiounit_uninstall_device_changed_callback(stm); + if (r != CUBEB_OK) { + LOG("(%p) Could not uninstall all device change listeners", stm); + } stm->shutdown = 1; diff --git a/netwerk/sctp/src/netinet/sctp.h b/netwerk/sctp/src/netinet/sctp.h index a5ff4eb0b..292cb7ca7 100755 --- a/netwerk/sctp/src/netinet/sctp.h +++ b/netwerk/sctp/src/netinet/sctp.h @@ -597,8 +597,10 @@ struct sctp_error_no_user_data { #define SCTP_MOBILITY_FASTHANDOFF 0x00000002 #define SCTP_MOBILITY_PRIM_DELETED 0x00000004 - -#define SCTP_SMALLEST_PMTU 512 /* smallest pmtu allowed when disabling PMTU discovery */ +/* Smallest PMTU allowed when disabling PMTU discovery */ +#define SCTP_SMALLEST_PMTU 512 +/* Largest PMTU allowed when disabling PMTU discovery */ +#define SCTP_LARGEST_PMTU 65536 #if defined(__Userspace_os_Windows) #pragma pack() diff --git a/netwerk/sctp/src/netinet/sctp_auth.c b/netwerk/sctp/src/netinet/sctp_auth.c index ee5ca36ce..094698a51 100755 --- a/netwerk/sctp/src/netinet/sctp_auth.c +++ b/netwerk/sctp/src/netinet/sctp_auth.c @@ -1450,7 +1450,8 @@ sctp_auth_get_cookie_params(struct sctp_tcb *stcb, struct mbuf *m, ptype = ntohs(phdr->param_type); plen = ntohs(phdr->param_length); - if ((plen == 0) || (offset + plen > length)) + if ((plen < sizeof(struct sctp_paramhdr)) || + (offset + plen > length)) break; if (ptype == SCTP_RANDOM) { diff --git a/netwerk/sctp/src/netinet/sctp_pcb.c b/netwerk/sctp/src/netinet/sctp_pcb.c index 58c164f50..2f88a7fab 100755 --- a/netwerk/sctp/src/netinet/sctp_pcb.c +++ b/netwerk/sctp/src/netinet/sctp_pcb.c @@ -7213,7 +7213,7 @@ sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m, if (offset + plen > limit) { break; } - if (plen == 0) { + if (plen < sizeof(struct sctp_paramhdr)) { break; } #ifdef INET @@ -7413,6 +7413,9 @@ sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m, if (plen > sizeof(lstore)) { return (-23); } + if (plen < sizeof(struct sctp_asconf_addrv4_param)) { + return (-101); + } phdr = sctp_get_next_param(m, offset, (struct sctp_paramhdr *)&lstore, min(plen,sizeof(lstore))); diff --git a/netwerk/sctp/src/netinet/sctp_usrreq.c b/netwerk/sctp/src/netinet/sctp_usrreq.c index d24a21815..14a6027cc 100755 --- a/netwerk/sctp/src/netinet/sctp_usrreq.c +++ b/netwerk/sctp/src/netinet/sctp_usrreq.c @@ -5995,6 +5995,14 @@ sctp_setopt(struct socket *so, int optname, void *optval, size_t optsize, SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_USRREQ, EINVAL); return (EINVAL); } + if ((paddrp->spp_flags & SPP_PMTUD_DISABLE) && + ((paddrp->spp_pathmtu < SCTP_SMALLEST_PMTU) || + (paddrp->spp_pathmtu > SCTP_LARGEST_PMTU))) { + if (stcb) + SCTP_TCB_UNLOCK(stcb); + SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_USRREQ, EINVAL); + return (EINVAL); + } if (stcb != NULL) { /************************TCB SPECIFIC SET ******************/ @@ -6038,7 +6046,7 @@ sctp_setopt(struct socket *so, int optname, void *optval, size_t optsize, sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SOCKOPT, SCTP_SO_LOCKED); sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net); } - if ((paddrp->spp_flags & SPP_PMTUD_DISABLE) && (paddrp->spp_pathmtu >= SCTP_SMALLEST_PMTU)) { + if (paddrp->spp_flags & SPP_PMTUD_DISABLE) { if (SCTP_OS_TIMER_PENDING(&net->pmtu_timer.timer)) { sctp_timer_stop(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, net, SCTP_FROM_SCTP_USRREQ+SCTP_LOC_10); @@ -6160,7 +6168,7 @@ sctp_setopt(struct socket *so, int optname, void *optval, size_t optsize, } sctp_stcb_feature_on(inp, stcb, SCTP_PCB_FLAGS_DONOT_HEARTBEAT); } - if ((paddrp->spp_flags & SPP_PMTUD_DISABLE) && (paddrp->spp_pathmtu >= SCTP_SMALLEST_PMTU)) { + if (paddrp->spp_flags & SPP_PMTUD_DISABLE) { TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { if (SCTP_OS_TIMER_PENDING(&net->pmtu_timer.timer)) { sctp_timer_stop(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, net,