From f3413e94b990b472846c2e1c989f7f66ace5cbb4 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Tue, 21 May 2024 12:30:47 +0200 Subject: [PATCH 1/5] [network] Make http digest auth cnonce length configurable. --- modules/libpref/init/all.js | 6 ++++++ netwerk/protocol/http/nsHttpDigestAuth.cpp | 15 ++++++++++++--- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js index 85aacfd61b..682000aaf2 100644 --- a/modules/libpref/init/all.js +++ b/modules/libpref/init/all.js @@ -1646,6 +1646,12 @@ pref("network.http.keep_empty_response_headers_as_empty_string", true); // Max size, in bytes, for received HTTP response header. pref("network.http.max_response_header_size", 393216); +// This sets the nonce length to verify the server response (via a +// server-returned Authentication-Info header). Also used for session info. +// Note: Range-checked to 4..256, if OOB defaults to 16. +// Note: Chrome uses 16. Larger values may break sites. See Bug 1892449. +pref("network.http.digest_auth_cnonce_length", 16); + // default values for FTP // in a DSCP environment this should be 40 (0x28, or AF11), per RFC-4594, // Section 4.8 "High-Throughput Data Service Class", and 80 (0x50, or AF22) diff --git a/netwerk/protocol/http/nsHttpDigestAuth.cpp b/netwerk/protocol/http/nsHttpDigestAuth.cpp index ac2808fa8c..5f70b90e50 100644 --- a/netwerk/protocol/http/nsHttpDigestAuth.cpp +++ b/netwerk/protocol/http/nsHttpDigestAuth.cpp @@ -7,6 +7,7 @@ // HttpLog.h should generally be included first #include "HttpLog.h" +#include "mozilla/Preferences.h" #include "mozilla/Sprintf.h" #include "nsHttp.h" @@ -20,6 +21,7 @@ #include "nsCRT.h" #include "nsICryptoHash.h" #include "nsComponentManagerUtils.h" +#include "pk11pub.h" namespace mozilla { namespace net { @@ -302,9 +304,16 @@ nsHttpDigestAuth::GenerateCredentials(nsIHttpAuthenticableChannel *authChannel, // returned Authentication-Info header). also used for session info. // nsAutoCString cnonce; - static const char hexChar[] = "0123456789abcdef"; - for (int i=0; i<16; ++i) { - cnonce.Append(hexChar[(int)(15.0 * rand()/(RAND_MAX + 1.0))]); + nsTArray cnonceBuf; + int cnonceLength = Preferences::GetInt("network.http.digest_auth_cnonce_length", 16); + if (cnonceLength < 4 || cnonceLength > 256) { + cnonceLength = 16; + } + cnonceBuf.SetLength(cnonceLength / 2); + PK11_GenerateRandom(reinterpret_cast(cnonceBuf.Elements()), + cnonceBuf.Length()); + for (auto byte : cnonceBuf) { + cnonce.AppendPrintf("%02x", byte); } LOG((" cnonce=%s\n", cnonce.get())); From 552cd74b08a7bf72282b872f67abdde7bf3f540e Mon Sep 17 00:00:00 2001 From: Moonchild Date: Tue, 21 May 2024 13:19:48 +0200 Subject: [PATCH 2/5] [gfx] Clear mSharedBlobData if blob creation failed. --- gfx/thebes/gfxFontEntry.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/gfx/thebes/gfxFontEntry.cpp b/gfx/thebes/gfxFontEntry.cpp index 765332aef5..ac841a550c 100644 --- a/gfx/thebes/gfxFontEntry.cpp +++ b/gfx/thebes/gfxFontEntry.cpp @@ -520,8 +520,9 @@ ShareTableAndGetBlob(nsTArray&& aTable, mSharedBlobData, DeleteFontTableBlobData); if (mBlob == hb_blob_get_empty() ) { // The FontTableBlobData was destroyed during hb_blob_create(). - // The (empty) blob is still be held in the hashtable with a strong + // The (empty) blob will still be held in the hashtable with a strong // reference. + mSharedBlobData = nullptr; return hb_blob_reference(mBlob); } From 22830d18cf83016f10dac683c7bf0e4921027373 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Tue, 21 May 2024 13:24:45 +0200 Subject: [PATCH 3/5] [DOM] Clean up ReportLoadError and normalize error messages. --- dom/workers/ScriptLoader.cpp | 27 ++++++++++----------------- 1 file changed, 10 insertions(+), 17 deletions(-) diff --git a/dom/workers/ScriptLoader.cpp b/dom/workers/ScriptLoader.cpp index 561759cc4c..80dec34ec7 100644 --- a/dom/workers/ScriptLoader.cpp +++ b/dom/workers/ScriptLoader.cpp @@ -2243,9 +2243,10 @@ void ReportLoadError(ErrorResult& aRv, nsresult aLoadResult, MOZ_ASSERT(!aRv.Failed()); switch (aLoadResult) { - case NS_ERROR_FILE_NOT_FOUND: - case NS_ERROR_NOT_AVAILABLE: - aLoadResult = NS_ERROR_DOM_NETWORK_ERR; + case NS_ERROR_DOM_SECURITY_ERR: + case NS_ERROR_DOM_SYNTAX_ERR: + case NS_ERROR_DOM_NETWORK_ERR: + // These are OK, pass them through immediately. break; case NS_ERROR_MALFORMED_URI: @@ -2261,10 +2262,6 @@ void ReportLoadError(ErrorResult& aRv, nsresult aLoadResult, // for this case, because that will make it impossible for consumers to // realize that our error was NS_BINDING_ABORTED. aRv.Throw(aLoadResult); - return; - - case NS_ERROR_DOM_SECURITY_ERR: - case NS_ERROR_DOM_SYNTAX_ERR: break; case NS_ERROR_DOM_BAD_URI: @@ -2272,19 +2269,15 @@ void ReportLoadError(ErrorResult& aRv, nsresult aLoadResult, aLoadResult = NS_ERROR_DOM_SECURITY_ERR; break; + case NS_ERROR_FILE_NOT_FOUND: + case NS_ERROR_NOT_AVAILABLE: case NS_ERROR_CORRUPTED_CONTENT: + // For lack of anything better, go ahead and throw a NetworkError here. + // We don't want to throw a JS exception, because for toplevel script + // loads that would get squelched. + default: aLoadResult = NS_ERROR_DOM_NETWORK_ERR; break; - - default: - // For lack of anything better, go ahead and throw a NetworkError here. - // We don't want to throw a JS exception, because for toplevel script - // loads that would get squelched. - aRv.ThrowDOMException(NS_ERROR_DOM_NETWORK_ERR, - nsPrintfCString("Failed to load worker script at %s (nsresult = 0x%x)", - NS_ConvertUTF16toUTF8(aScriptURL).get(), - aLoadResult)); - return; } aRv.ThrowDOMException(aLoadResult, From 7672f932f752d9d925b0915b291d2099f894bb45 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Tue, 21 May 2024 14:10:27 +0200 Subject: [PATCH 4/5] [gfx] Ensure font entry's unitsPerEm and font extents are initialized when gfxFont is created. --- gfx/thebes/gfxFont.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/gfx/thebes/gfxFont.cpp b/gfx/thebes/gfxFont.cpp index 383cc19042..9c3cf6a3d1 100644 --- a/gfx/thebes/gfxFont.cpp +++ b/gfx/thebes/gfxFont.cpp @@ -860,6 +860,10 @@ gfxFont::gfxFont(gfxFontEntry *aFontEntry, const gfxFontStyle *aFontStyle, ++gFontCount; #endif mKerningSet = HasFeatureSet(HB_TAG('k','e','r','n'), mKerningEnabled); + + // Ensure the gfxFontEntry's unitsPerEm and extents fields are initialized, + // so that GetFontExtents can use them without risk of races. + Unused << mFontEntry->UnitsPerEm(); } gfxFont::~gfxFont() From 7d2ecc13dd7b7e81f7afa6054b2174b09de026d0 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Tue, 21 May 2024 15:04:22 +0200 Subject: [PATCH 5/5] [gfx] Use calloc for cairo font-creation functions. --- gfx/cairo/cairo/src/cairo-cff-subset.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gfx/cairo/cairo/src/cairo-cff-subset.c b/gfx/cairo/cairo/src/cairo-cff-subset.c index 6a5060047f..d4d119cc2c 100644 --- a/gfx/cairo/cairo/src/cairo-cff-subset.c +++ b/gfx/cairo/cairo/src/cairo-cff-subset.c @@ -1726,7 +1726,7 @@ _cairo_cff_font_create (cairo_scaled_font_subset_t *scaled_font_subset, if (unlikely (status)) return status; - font = malloc (sizeof (cairo_cff_font_t)); + font = calloc (1, sizeof (cairo_cff_font_t)); if (unlikely (font == NULL)) return _cairo_error (CAIRO_STATUS_NO_MEMORY); @@ -1994,7 +1994,7 @@ _cairo_cff_font_fallback_create (cairo_scaled_font_subset_t *scaled_font_subset cairo_status_t status; cairo_cff_font_t *font; - font = malloc (sizeof (cairo_cff_font_t)); + font = calloc (1, sizeof (cairo_cff_font_t)); if (unlikely (font == NULL)) return _cairo_error (CAIRO_STATUS_NO_MEMORY);