wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-25 18:07:31 +09:00
Code Issues Projects Releases Packages Wiki Activity

[js] Disallow deserializing structured clone buffers with transferables more than once.

Browse source
This commit is contained in:
Steve Fink 2024-10-01 22:22:04 +02:00 • committed by roytam1
commit 9a6e3bc30d
3 changed files with 29 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

1
js/public/StructuredClone.h
View file

@ -472,6 +472,7 @@ class JS_PUBLIC_API(JSAutoStructuredCloneBuffer) {
#define JS_SCERR_TRANSFERABLE 1 #define JS_SCERR_TRANSFERABLE 1
#define JS_SCERR_DUP_TRANSFERABLE 2 #define JS_SCERR_DUP_TRANSFERABLE 2
#define JS_SCERR_UNSUPPORTED_TYPE 3 #define JS_SCERR_UNSUPPORTED_TYPE 3
#define JS_SCERR_TRANSFERABLE_TWICE 4
JS_PUBLIC_API(bool) JS_PUBLIC_API(bool)
JS_ReadUint32Pair(JSStructuredCloneReader* r, uint32_t* p1, uint32_t* p2); JS_ReadUint32Pair(JSStructuredCloneReader* r, uint32_t* p1, uint32_t* p2);

1
js/src/js.msg
View file

@ -440,6 +440,7 @@ MSG_DEF(JSMSG_SC_BAD_CLONE_VERSION, 0, JSEXN_ERR, "unsupported structured clo
MSG_DEF(JSMSG_SC_BAD_SERIALIZED_DATA, 1, JSEXN_INTERNALERR, "bad serialized structured data ({0})") MSG_DEF(JSMSG_SC_BAD_SERIALIZED_DATA, 1, JSEXN_INTERNALERR, "bad serialized structured data ({0})")
MSG_DEF(JSMSG_SC_DUP_TRANSFERABLE, 0, JSEXN_TYPEERR, "duplicate transferable for structured clone") MSG_DEF(JSMSG_SC_DUP_TRANSFERABLE, 0, JSEXN_TYPEERR, "duplicate transferable for structured clone")
MSG_DEF(JSMSG_SC_NOT_TRANSFERABLE, 0, JSEXN_TYPEERR, "invalid transferable array for structured clone") MSG_DEF(JSMSG_SC_NOT_TRANSFERABLE, 0, JSEXN_TYPEERR, "invalid transferable array for structured clone")
MSG_DEF(JSMSG_SC_TRANSFERABLE_TWICE, 0, JSEXN_TYPEERR, "structured clone cannot transfer twice")
MSG_DEF(JSMSG_SC_UNSUPPORTED_TYPE, 0, JSEXN_TYPEERR, "unsupported type for structured data") MSG_DEF(JSMSG_SC_UNSUPPORTED_TYPE, 0, JSEXN_TYPEERR, "unsupported type for structured data")
MSG_DEF(JSMSG_SC_NOT_CLONABLE, 1, JSEXN_TYPEERR, "{0} cannot be cloned in this context") MSG_DEF(JSMSG_SC_NOT_CLONABLE, 1, JSEXN_TYPEERR, "{0} cannot be cloned in this context")
MSG_DEF(JSMSG_SC_SAB_TRANSFER, 0, JSEXN_WARN, "SharedArrayBuffer must not be in the transfer list") MSG_DEF(JSMSG_SC_SAB_TRANSFER, 0, JSEXN_WARN, "SharedArrayBuffer must not be in the transfer list")

36
js/src/vm/StructuredClone.cpp
View file

@ -140,18 +140,23 @@ enum StructuredDataType : uint32_t {
/* /*
* Format of transfer map: * Format of transfer map:
* <SCTAG_TRANSFER_MAP_HEADER, TransferableMapHeader(UNREAD|TRANSFERRED)> * - <SCTAG_TRANSFER_MAP_HEADER, UNREAD|TRANSFERRING|TRANSFERRED>
* numTransferables (64 bits) * - numTransferables (64 bits)
* array of: * - array of:
* <SCTAG_TRANSFER_MAP_*, TransferableOwnership> * - <SCTAG_TRANSFER_MAP_*, TransferableOwnership> pointer (64
* pointer (64 bits) * bits)
* extraData (64 bits), eg byte length for ArrayBuffers * - extraData (64 bits), eg byte length for ArrayBuffers
* - any data written for custom transferables
*/ */
// Data associated with an SCTAG_TRANSFER_MAP_HEADER that tells whether the // Data associated with an SCTAG_TRANSFER_MAP_HEADER that tells whether the
// contents have been read out yet or not. // contents have been read out yet or not. TRANSFERRING is for the case where we
// have started but not completed reading, which due to errors could mean that
// there are things still owned by the clone buffer that need to be released, so
// discarding should not just be skipped.
enum TransferableMapHeader { enum TransferableMapHeader {
SCTAG_TM_UNREAD = 0, SCTAG_TM_UNREAD = 0,
SCTAG_TM_TRANSFERRING,
SCTAG_TM_TRANSFERRED SCTAG_TM_TRANSFERRED
}; };
@ -530,6 +535,10 @@ ReportDataCloneError(JSContext* cx,
JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_SC_UNSUPPORTED_TYPE); JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_SC_UNSUPPORTED_TYPE);
break; break;
case JS_SCERR_TRANSFERABLE_TWICE:
JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_SC_TRANSFERABLE_TWICE);
break;
default: default:
MOZ_CRASH("Unkown errorId"); MOZ_CRASH("Unkown errorId");
break; break;
@ -2325,9 +2334,18 @@ JSStructuredCloneReader::readTransferMap()
if (!in.getPair(&tag, &data)) if (!in.getPair(&tag, &data))
return in.reportTruncated(); return in.reportTruncated();
if (tag != SCTAG_TRANSFER_MAP_HEADER || TransferableMapHeader(data) == SCTAG_TM_TRANSFERRED) auto transferState = static_cast<TransferableMapHeader>(data);
if (tag != SCTAG_TRANSFER_MAP_HEADER || transferState == SCTAG_TM_TRANSFERRED)
return true; return true;
if (transferState == SCTAG_TM_TRANSFERRING) {
ReportDataCloneError(cx, callbacks, JS_SCERR_TRANSFERABLE_TWICE);
return false;
}
headerPos.write(PairToUInt64(SCTAG_TRANSFER_MAP_HEADER, SCTAG_TM_TRANSFERRING));
uint64_t numTransferables; uint64_t numTransferables;
MOZ_ALWAYS_TRUE(in.readPair(&tag, &data)); MOZ_ALWAYS_TRUE(in.readPair(&tag, &data));
if (!in.read(&numTransferables)) if (!in.read(&numTransferables))
@ -2414,7 +2432,7 @@ JSStructuredCloneReader::readTransferMap()
#ifdef DEBUG #ifdef DEBUG
SCInput::getPair(headerPos.peek(), &tag, &data); SCInput::getPair(headerPos.peek(), &tag, &data);
MOZ_ASSERT(tag == SCTAG_TRANSFER_MAP_HEADER); MOZ_ASSERT(tag == SCTAG_TRANSFER_MAP_HEADER);
MOZ_ASSERT(TransferableMapHeader(data) != SCTAG_TM_TRANSFERRED); MOZ_ASSERT(TransferableMapHeader(data) == SCTAG_TM_TRANSFERRING);
#endif #endif
headerPos.write(PairToUInt64(SCTAG_TRANSFER_MAP_HEADER, SCTAG_TM_TRANSFERRED)); headerPos.write(PairToUInt64(SCTAG_TRANSFER_MAP_HEADER, SCTAG_TM_TRANSFERRED));