wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-05 07:18:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

[DOM] Fix crash in <object> scheme checking code.

Browse source 
If a website would nor supply a URI for object loading code, the browser
would crash on a null deref.
This reintroduces the nestedURI check to make sure we have a valid URI.
This commit is contained in:
Moonchild 2025-07-30 09:29:26 +02:00 • committed by roytam1
commit 838be26145
1 changed files with 9 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

15
dom/base/nsObjectLoadingContent.cpp
View file

@ -2326,16 +2326,19 @@ nsObjectLoadingContent::LoadObject(bool aNotify,
// if the scheme of `mURI` is one that would return a network error. The
// following schemes are allowed through in scheme fetch:
// "about", "blob", "data", "file", "http", "https".
// XXXMC: Should we include "ftp" as well?
//
// Some accessibility tests use our internal "chrome" scheme.
if (mType != eType_Null) {
nsCOMPtr<nsIURI> tempURI = mURI;
nsCOMPtr<nsINestedURI> nestedURI = do_QueryInterface(tempURI);
bool isCandidate = false;
for (const auto& candidate :
{"about", "blob", "chrome", "data", "file", "http", "https"}) {
rv = mURI->SchemeIs(candidate, &isCandidate);
if (NS_SUCCEEDED(rv) && isCandidate) {
break;
if (nestedURI) {
for (const auto& candidate :
{"about", "blob", "chrome", "data", "file", "http", "https"}) {
rv = tempURI->SchemeIs(candidate, &isCandidate);
if (NS_SUCCEEDED(rv) && isCandidate) {
break;
}
}
}
if (!isCandidate) {