82764 2012-03-30 11:50:41 -0700 [BlackBerry] PluginBlackBerry may leak strings 2012-03-30 13:19:43 -0700 1 1 1 Unclassified WebKit Plug-ins 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 joenotcharles joenotcharles manyoso webkit.review.bot oldest_to_newest 592357 0 joenotcharles 2012-03-30 11:50:41 -0700 The BlackBerry::Platform::Window API has been updated to return std::string instead of char* from some methods. When I updated webkit for this change, I noticed that PluginViewBlackBerry takes the returned strings and stuffs a pointer to them into an NPSetWindowCallbackStruct, where they are passed to the plugin. It's not clear to me that the lifetime of the plugin is guaranteed to be tied to the window, and if the window is destroyed first this memory will become invalid. So it's safer to also store a copy in the PluginBlackBerry object and put the pointer to that in the callback struct, so we can more carefully manage its lifetime. 592362 1 134851 joenotcharles 2012-03-30 11:56:20 -0700 Created attachment 134851 fix 592369 2 134851 rwlbuis 2012-03-30 12:01:18 -0700 Comment on attachment 134851 fix View in context: https://bugs.webkit.org/attachment.cgi?id=134851&action=review Looks good. > Source/WebCore/ChangeLog:12 > + Reviewed by NOBODY (OOPS!). This line should be between title and explanation. Please do that next time :) 592442 3 134851 webkit.review.bot 2012-03-30 13:19:39 -0700 Comment on attachment 134851 fix Clearing flags on attachment: 134851 Committed r112714: <http://trac.webkit.org/changeset/112714> 592443 4 webkit.review.bot 2012-03-30 13:19:43 -0700 All reviewed patches have been landed. Closing bug. 134851 2012-03-30 11:56:20 -0700 2012-03-30 13:19:39 -0700 fix 0001-BlackBerry-Make-sure-strings-do-not-leak-in-PluginVi.patch text/plain 6593 joenotcharles RnJvbSBkMDhiZDRmN2Q3OTg1YmI5NGEwMjQxOWUyNmFlM2I1MjM2Y2RhMjBlIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBKb2UgTWFzb24gPGptYXNvbkByaW0uY29tPgpEYXRlOiBGcmks IDMwIE1hciAyMDEyIDE0OjU0OjU5IC0wNDAwClN1YmplY3Q6IFtQQVRDSF0gW0JsYWNrQmVycnld IE1ha2Ugc3VyZSBzdHJpbmdzIGRvIG5vdCBsZWFrIGluCiBQbHVnaW5WaWV3QmxhY2tiZXJyeS4K IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD04Mjc2NAoKVXBkYXRlIFBs dWdpblZpZXdCbGFja0JlcnJ5IHRvIGZvbGxvdyB0aGUgY2hhbmdlcyBpbgpCbGFja0JlcnJ5OjpQ bGF0Zm9ybTo6V2luZG93IHdoaWNoIG5vdyByZXR1cm5zIHN0ZDo6c3RyaW5nIGluc3RlYWQgb2Yg Y2hhciogZm9yCnN0cmluZ3MuIEFsc28gY29weSB0aGUgd2luZG93R3JvdXAgYW5kIHJvb3RHcm91 cCBzdHJpbmdzIGluIFBsdWdpblZpZXdQcml2YXRlCmluc3RlYWQgb2YganVzdCBzYXZpbmcgYSBw b2ludGVyIHRvIHRoZSByZXR1cm5lZCBtZW1vcnksIHdoaWNoIGNvdWxkIGJlY29tZQppbnZhbGlk IGF0IGFueSB0aW1lLgoKUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCgoqIHBsdWdpbnMvYmxh Y2tiZXJyeS9QbHVnaW5WaWV3QmxhY2tCZXJyeS5jcHA6CihXZWJDb3JlOjpQbHVnaW5WaWV3Ojpz ZXROUFdpbmRvd0lmTmVlZGVkKToKKFdlYkNvcmU6OlBsdWdpblZpZXc6OnBsYXRmb3JtR2V0VmFs dWUpOgooV2ViQ29yZTo6UGx1Z2luVmlldzo6cGxhdGZvcm1EZXN0cm95KToKKiBwbHVnaW5zL2Js YWNrYmVycnkvUGx1Z2luVmlld1ByaXZhdGVCbGFja0JlcnJ5Lmg6CihQbHVnaW5WaWV3UHJpdmF0 ZSk6Ci0tLQogU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgIDIwICsrKysrKysrKysrKysrKysKIC4uLi9wbHVnaW5zL2JsYWNrYmVycnkvUGx1Z2lu Vmlld0JsYWNrQmVycnkuY3BwICAgIHwgICAyNSArKysrKysrKysrKysrKysrLS0tLQogLi4uL2Js YWNrYmVycnkvUGx1Z2luVmlld1ByaXZhdGVCbGFja0JlcnJ5LmggICAgICAgfCAgICAyICsKIDMg ZmlsZXMgY2hhbmdlZCwgNDIgaW5zZXJ0aW9ucygrKSwgNSBkZWxldGlvbnMoLSkKCmRpZmYgLS1n aXQgYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cK aW5kZXggMGM4Y2JkYS4uODI0YzA2NSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdl TG9nCisrKyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIzIEBACisyMDEy LTAzLTMwICBKb2UgTWFzb24gIDxqbWFzb25AcmltLmNvbT4KKworICAgICAgICBbQmxhY2tCZXJy eV0gTWFrZSBzdXJlIHN0cmluZ3MgZG8gbm90IGxlYWsgaW4gUGx1Z2luVmlld0JsYWNrYmVycnku CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD04Mjc2NAor CisgICAgICAgIFVwZGF0ZSBQbHVnaW5WaWV3QmxhY2tCZXJyeSB0byBmb2xsb3cgdGhlIGNoYW5n ZXMgaW4KKyAgICAgICAgQmxhY2tCZXJyeTo6UGxhdGZvcm06OldpbmRvdyB3aGljaCBub3cgcmV0 dXJucyBzdGQ6OnN0cmluZyBpbnN0ZWFkIG9mIGNoYXIqIGZvcgorICAgICAgICBzdHJpbmdzLiBB bHNvIGNvcHkgdGhlIHdpbmRvd0dyb3VwIGFuZCByb290R3JvdXAgc3RyaW5ncyBpbiBQbHVnaW5W aWV3UHJpdmF0ZQorICAgICAgICBpbnN0ZWFkIG9mIGp1c3Qgc2F2aW5nIGEgcG9pbnRlciB0byB0 aGUgcmV0dXJuZWQgbWVtb3J5LCB3aGljaCBjb3VsZCBiZWNvbWUKKyAgICAgICAgaW52YWxpZCBh dCBhbnkgdGltZS4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAg ICAgICAqIHBsdWdpbnMvYmxhY2tiZXJyeS9QbHVnaW5WaWV3QmxhY2tCZXJyeS5jcHA6CisgICAg ICAgIChXZWJDb3JlOjpQbHVnaW5WaWV3OjpzZXROUFdpbmRvd0lmTmVlZGVkKToKKyAgICAgICAg KFdlYkNvcmU6OlBsdWdpblZpZXc6OnBsYXRmb3JtR2V0VmFsdWUpOgorICAgICAgICAoV2ViQ29y ZTo6UGx1Z2luVmlldzo6cGxhdGZvcm1EZXN0cm95KToKKyAgICAgICAgKiBwbHVnaW5zL2JsYWNr YmVycnkvUGx1Z2luVmlld1ByaXZhdGVCbGFja0JlcnJ5Lmg6CisgICAgICAgIChQbHVnaW5WaWV3 UHJpdmF0ZSk6CisKIDIwMTItMDMtMjggIEphc29uIExpdSAgPGphc29uLmxpdUB0b3JjaG1vYmls ZS5jb20uY24+CiAKICAgICAgICAgW0JsYWNrQmVycnldTWlzc2luZyBjb29raWVzIGZyb20gSFRU UCByZXNwb25zZSBoZWFkZXIgaW4gTmV0d29yayB0YWIgb2YgV2ViIEluc3BlY3Rvci4KZGlmZiAt LWdpdCBhL1NvdXJjZS9XZWJDb3JlL3BsdWdpbnMvYmxhY2tiZXJyeS9QbHVnaW5WaWV3QmxhY2tC ZXJyeS5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9wbHVnaW5zL2JsYWNrYmVycnkvUGx1Z2luVmlld0Js YWNrQmVycnkuY3BwCmluZGV4IDI4MjMwNGYuLmM1Mjg3MmEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9X ZWJDb3JlL3BsdWdpbnMvYmxhY2tiZXJyeS9QbHVnaW5WaWV3QmxhY2tCZXJyeS5jcHAKKysrIGIv U291cmNlL1dlYkNvcmUvcGx1Z2lucy9ibGFja2JlcnJ5L1BsdWdpblZpZXdCbGFja0JlcnJ5LmNw cApAQCAtMiw3ICsyLDcgQEAKICAqIENvcHlyaWdodCAoQykgMjAwNiwgMjAwNyBBcHBsZSBJbmMu ICBBbGwgcmlnaHRzIHJlc2VydmVkLgogICogQ29weXJpZ2h0IChDKSAyMDA4IENvbGxhYm9yYSBM dGQuIEFsbCByaWdodHMgcmVzZXJ2ZWQuCiAgKiBDb3B5cmlnaHQgKEMpIDIwMDkgR2lyaXNoIFJh bWFrcmlzaG5hbiA8Z2lyaXNoQGZvcndhcmRiaWFzLmluPgotICogQ29weXJpZ2h0IChDKSAyMDEx IFJlc2VhcmNoIEluIE1vdGlvbiBMaW1pdGVkLiBBbGwgcmlnaHRzIHJlc2VydmVkLgorICogQ29w eXJpZ2h0IChDKSAyMDExLCAyMDEyIFJlc2VhcmNoIEluIE1vdGlvbiBMaW1pdGVkLiBBbGwgcmln aHRzIHJlc2VydmVkLgogICoKICAqIFJlZGlzdHJpYnV0aW9uIGFuZCB1c2UgaW4gc291cmNlIGFu ZCBiaW5hcnkgZm9ybXMsIHdpdGggb3Igd2l0aG91dAogICogbW9kaWZpY2F0aW9uLCBhcmUgcGVy bWl0dGVkIHByb3ZpZGVkIHRoYXQgdGhlIGZvbGxvd2luZyBjb25kaXRpb25zCkBAIC05NzMsOCAr OTczLDExIEBAIHZvaWQgUGx1Z2luVmlldzo6c2V0TlBXaW5kb3dJZk5lZWRlZCgpCiAgICAgbV9u cFdpbmRvdy50eXBlID0gTlBXaW5kb3dUeXBlRHJhd2FibGU7CiAKICAgICBCbGFja0JlcnJ5OjpQ bGF0Zm9ybTo6R3JhcGhpY3M6OldpbmRvdyogd2luZG93ID0gZnJhbWVWaWV3LT5ob3N0V2luZG93 KCktPnBsYXRmb3JtUGFnZUNsaWVudCgpLT5wbGF0Zm9ybVdpbmRvdygpOwotICAgIGlmICh3aW5k b3cpCi0gICAgICAgICgoTlBTZXRXaW5kb3dDYWxsYmFja1N0cnVjdCopbV9ucFdpbmRvdy53c19p bmZvKS0+d2luZG93R3JvdXAgPSB3aW5kb3ctPndpbmRvd0dyb3VwKCk7CisgICAgaWYgKHdpbmRv dykgeworICAgICAgICAvLyBNYWtlIGEgbG9jYWwgY29weSBvZiB0aGUgd2luZG93IGdyb3VwIHRv IGJlIHN1cmUgaXQgZG9lc24ndCBnbyBvdXQgb2Ygc2NvcGUgd2hpbGUgdGhlIHdzX2luZm8gc3Ry dWN0IGV4aXN0cworICAgICAgICBtX3ByaXZhdGUtPm1fd2luZG93R3JvdXAgPSB3aW5kb3ctPndp bmRvd0dyb3VwKCk7CisgICAgICAgICgoTlBTZXRXaW5kb3dDYWxsYmFja1N0cnVjdCopIG1fbnBX aW5kb3cud3NfaW5mbyktPndpbmRvd0dyb3VwID0gbV9wcml2YXRlLT5tX3dpbmRvd0dyb3VwLmNf c3RyKCk7CisgICAgfQogCiAgICAgUGx1Z2luVmlldzo6c2V0Q3VycmVudFBsdWdpblZpZXcodGhp cyk7CiAgICAgSlNDOjpKU0xvY2s6OkRyb3BBbGxMb2NrcyBkcm9wQWxsTG9ja3MoSlNDOjpTaWxl bmNlQXNzZXJ0aW9uc09ubHkpOwpAQCAtMTA5Myw4ICsxMDk2LDEyIEBAIGJvb2wgUGx1Z2luVmll dzo6cGxhdGZvcm1HZXRWYWx1ZShOUE5WYXJpYWJsZSB2YXJpYWJsZSwgdm9pZCogdmFsdWUsIE5Q RXJyb3IqIHJlCiAgICAgICAgIGlmIChmcmFtZVZpZXcpIHsKICAgICAgICAgICAgIEJsYWNrQmVy cnk6OlBsYXRmb3JtOjpHcmFwaGljczo6V2luZG93ICp3aW5kb3cgPSBmcmFtZVZpZXctPmhvc3RX aW5kb3coKS0+cGxhdGZvcm1QYWdlQ2xpZW50KCktPnBsYXRmb3JtV2luZG93KCk7CiAgICAgICAg ICAgICBpZiAod2luZG93KSB7CisgICAgICAgICAgICAgICAgLy8gTWFrZSBhIGNvcHkgb2YgdGhl IHJvb3QgZ3JvdXAgdG8gYmUgc3VyZSBpdCBkb2Vzbid0IGdvIG91dCBvZiBzY29wZS4KKyAgICAg ICAgICAgICAgICBtX3ByaXZhdGUtPm1fcm9vdEdyb3VwID0gd2luZG93LT5yb290R3JvdXAoKTsK KworICAgICAgICAgICAgICAgIC8vIFN0b3JlIGl0IGludG8gdmFsdWUgdGhyb3VnaCBhbiBpbmRp cmVjdCBwb2ludGVyLgogICAgICAgICAgICAgICAgIHZvaWQqKiB0ZW1wVmFsdWUgPSBzdGF0aWNf Y2FzdDx2b2lkKio+KHZhbHVlKTsKLSAgICAgICAgICAgICAgICAqdGVtcFZhbHVlID0gKHZvaWQq KXdpbmRvdy0+cm9vdEdyb3VwKCk7CisgICAgICAgICAgICAgICAgKnRlbXBWYWx1ZSA9IHJlaW50 ZXJwcmV0X2Nhc3Q8dm9pZCo+KGNvbnN0X2Nhc3Q8Y2hhcio+KG1fcHJpdmF0ZS0+bV9yb290R3Jv dXAuY19zdHIoKSkpOwogCiAgICAgICAgICAgICAgICAgaWYgKCp0ZW1wVmFsdWUpIHsKICAgICAg ICAgICAgICAgICAgICAgKnJlc3VsdCA9IE5QRVJSX05PX0VSUk9SOwpAQCAtMTExMSw4ICsxMTE4 LDEyIEBAIGJvb2wgUGx1Z2luVmlldzo6cGxhdGZvcm1HZXRWYWx1ZShOUE5WYXJpYWJsZSB2YXJp YWJsZSwgdm9pZCogdmFsdWUsIE5QRXJyb3IqIHJlCiAgICAgICAgIGlmIChmcmFtZVZpZXcpIHsK ICAgICAgICAgICAgIEJsYWNrQmVycnk6OlBsYXRmb3JtOjpHcmFwaGljczo6V2luZG93KiB3aW5k b3cgPSBmcmFtZVZpZXctPmhvc3RXaW5kb3coKS0+cGxhdGZvcm1QYWdlQ2xpZW50KCktPnBsYXRm b3JtV2luZG93KCk7CiAgICAgICAgICAgICBpZiAod2luZG93KSB7CisgICAgICAgICAgICAgICAg Ly8gTWFrZSBhIGNvcHkgb2YgdGhlIHdpbmRvdyBncm91cCB0byBiZSBzdXJlIGl0IGRvZXNuJ3Qg Z28gb3V0IG9mIHNjb3BlLgorICAgICAgICAgICAgICAgIG1fcHJpdmF0ZS0+bV93aW5kb3dHcm91 cCA9IHdpbmRvdy0+d2luZG93R3JvdXAoKTsKKworICAgICAgICAgICAgICAgIC8vIFN0b3JlIGl0 IGludG8gdmFsdWUgdGhyb3VnaCBhbiBpbmRpcmVjdCBwb2ludGVyLgogICAgICAgICAgICAgICAg IHZvaWQqKiB0ZW1wVmFsdWUgPSBzdGF0aWNfY2FzdDx2b2lkKio+KHZhbHVlKTsKLSAgICAgICAg ICAgICAgICAqdGVtcFZhbHVlID0gcmVpbnRlcnByZXRfY2FzdDx2b2lkKj4oY29uc3RfY2FzdDxj aGFyKj4od2luZG93LT53aW5kb3dHcm91cCgpKSk7CisgICAgICAgICAgICAgICAgKnRlbXBWYWx1 ZSA9IHJlaW50ZXJwcmV0X2Nhc3Q8dm9pZCo+KGNvbnN0X2Nhc3Q8Y2hhcio+KG1fcHJpdmF0ZS0+ bV93aW5kb3dHcm91cC5jX3N0cigpKSk7CiAKICAgICAgICAgICAgICAgICBpZiAoKnRlbXBWYWx1 ZSkgewogICAgICAgICAgICAgICAgICAgICAqcmVzdWx0ID0gTlBFUlJfTk9fRVJST1I7CkBAIC0x MjcyLDYgKzEyODMsMTAgQEAgdm9pZCBQbHVnaW5WaWV3OjpwbGF0Zm9ybURlc3Ryb3koKQogICAg IGlmICghbV9wcml2YXRlKQogICAgICAgICByZXR1cm47CiAKKyAgICAvLyB3c19pbmZvLT53aW5k b3dHcm91cCBwb2ludHMgdG8gbWVtb3J5IGluIG1fcHJpdmF0ZSwgd2hpY2ggaXMgYWJvdXQgdG8g Z28gYXdheSAodW5sZXNzIGl0IGlzIHVuaW5pdGlhbGl6ZWQgYXQgdGhpcyBwb2ludCkKKyAgICBp ZiAobV9ucFdpbmRvdy53c19pbmZvKQorICAgICAgICAoKE5QU2V0V2luZG93Q2FsbGJhY2tTdHJ1 Y3QqKW1fbnBXaW5kb3cud3NfaW5mbyktPndpbmRvd0dyb3VwID0gMDsKKwogICAgIC8vIFRoaXMg d2lsbCB1bmxvY2sgdGhlIGlkbGUgKGlmIHdlIGhhdmUgbG9ja2VkIGl0KS4KICAgICBtX3ByaXZh dGUtPnByZXZlbnRJZGxlKGZhbHNlKTsKIApkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcGx1 Z2lucy9ibGFja2JlcnJ5L1BsdWdpblZpZXdQcml2YXRlQmxhY2tCZXJyeS5oIGIvU291cmNlL1dl YkNvcmUvcGx1Z2lucy9ibGFja2JlcnJ5L1BsdWdpblZpZXdQcml2YXRlQmxhY2tCZXJyeS5oCmlu ZGV4IDNmMjg3OGYuLmI5ZGQyMTggMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3BsdWdpbnMv YmxhY2tiZXJyeS9QbHVnaW5WaWV3UHJpdmF0ZUJsYWNrQmVycnkuaAorKysgYi9Tb3VyY2UvV2Vi Q29yZS9wbHVnaW5zL2JsYWNrYmVycnkvUGx1Z2luVmlld1ByaXZhdGVCbGFja0JlcnJ5LmgKQEAg LTgzLDYgKzgzLDggQEAgcHJpdmF0ZToKICAgICBib29sIG1faXNCYWNrZ3JvdW5kUGxheWluZzsK IAogICAgIHN0ZDo6c3RyaW5nIG1fcGx1Z2luVW5pcXVlUHJlZml4OworICAgIHN0ZDo6c3RyaW5n IG1fd2luZG93R3JvdXA7CisgICAgc3RkOjpzdHJpbmcgbV9yb290R3JvdXA7CiAKICAgICBCbGFj a0JlcnJ5OjpQbGF0Zm9ybTo6SW50UmVjdFJlZ2lvbiBtX2ludmFsaWRhdGVSZWdpb247CiAgICAg ZnJpZW5kIGNsYXNzIFBsdWdpblZpZXc7Ci0tIAoxLjcuNS40Cgo=