guix-devel/gnu/packages/patches/icecat-CVE-2015-2722-pt1.patch

78 lines
2.3 KiB
Diff

From 7805485b75d06915bcb018b8fe5cb7de4ddebddb Mon Sep 17 00:00:00 2001
From: Andrea Marchesini <amarchesini@mozilla.com>
Date: Wed, 27 May 2015 14:21:44 -0700
Subject: [PATCH] Bug 1166924 part 0 r=bent a=lizzard
--HG--
extra : source : 36bf5bcceb272fc9e303996f8dfe7350984a5e96
---
dom/workers/XMLHttpRequest.cpp | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/dom/workers/XMLHttpRequest.cpp b/dom/workers/XMLHttpRequest.cpp
index 748fd39..8e4200a 100644
--- a/dom/workers/XMLHttpRequest.cpp
+++ b/dom/workers/XMLHttpRequest.cpp
@@ -113,6 +113,7 @@ public:
bool mLastUploadLengthComputable;
bool mSeenLoadStart;
bool mSeenUploadLoadStart;
+ bool mOpening;
// Only touched on the main thread.
bool mUploadEventListenersAttached;
@@ -127,7 +128,7 @@ public:
mOuterEventStreamId(0), mOuterChannelId(0), mLastLoaded(0), mLastTotal(0),
mLastUploadLoaded(0), mLastUploadTotal(0), mIsSyncXHR(false),
mLastLengthComputable(false), mLastUploadLengthComputable(false),
- mSeenLoadStart(false), mSeenUploadLoadStart(false),
+ mSeenLoadStart(false), mSeenUploadLoadStart(false), mOpening(false),
mUploadEventListenersAttached(false), mMainThreadSeenLoadStart(false),
mInOpen(false)
{ }
@@ -1498,7 +1499,11 @@ SendRunnable::MainThreadRun()
variant = wvariant;
}
- MOZ_ASSERT(!mProxy->mWorkerPrivate);
+ // Send() has been already called.
+ if (mProxy->mWorkerPrivate) {
+ return NS_ERROR_FAILURE;
+ }
+
mProxy->mWorkerPrivate = mWorkerPrivate;
MOZ_ASSERT(!mProxy->mSyncLoopTarget);
@@ -1789,6 +1794,12 @@ XMLHttpRequest::SendInternal(const nsAString& aStringBody,
{
mWorkerPrivate->AssertIsOnWorkerThread();
+ // No send() calls when open is running.
+ if (mProxy->mOpening) {
+ aRv.Throw(NS_ERROR_FAILURE);
+ return;
+ }
+
bool hasUploadListeners = mUpload ? mUpload->HasListeners() : false;
MaybePin(aRv);
@@ -1874,12 +1885,15 @@ XMLHttpRequest::Open(const nsACString& aMethod, const nsAString& aUrl,
mBackgroundRequest, mWithCredentials,
mTimeout);
+ mProxy->mOpening = true;
if (!runnable->Dispatch(mWorkerPrivate->GetJSContext())) {
ReleaseProxy();
+ mProxy->mOpening = false;
aRv.Throw(NS_ERROR_FAILURE);
return;
}
+ mProxy->mOpening = false;
mProxy->mIsSyncXHR = !aAsync;
}
--
2.4.3