Bug 24080

Summary: NPN_GetValue casting to the wrong type and writing outside bounds
Product: WebKit Reporter: Larry Ewing <lewing>
Component: Plug-insAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: andersca, ap
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
fix for the problem
none
Patch with ChangeLog
none
Patch for all platforms ap: review+

Description Larry Ewing 2009-02-22 11:40:32 PST
PluginView is casting NPBool types to uint32 and as a result writing outside the memory it owns potentially trashing the stack.
Comment 1 Larry Ewing 2009-02-22 11:41:38 PST
Created attachment 27868 [details]
fix for the problem
Comment 2 Larry Ewing 2009-02-23 07:58:18 PST
Created attachment 27881 [details]
Patch with ChangeLog
Comment 3 Alexey Proskuryakov 2009-02-23 13:40:53 PST
Comment on attachment 27881 [details]
Patch with ChangeLog

Looks like this was meant for review, marking as such.
Comment 4 Alexey Proskuryakov 2009-02-27 11:11:29 PST
Per IRC discussion, this is a problem on other platforms, too.
Comment 5 Alexey Proskuryakov 2009-02-27 11:35:23 PST
<http://src.chromium.org/viewvc/chrome/trunk/src/webkit/glue/plugins/plugin_host.cc> seems to have the same issue, even though this code doesn't look like it was derived from WebKit.
Comment 6 Anders Carlsson 2009-02-27 12:10:59 PST
Comment on attachment 27881 [details]
Patch with ChangeLog

r=me
Comment 7 Alexey Proskuryakov 2009-02-27 12:13:15 PST
Comment on attachment 27881 [details]
Patch with ChangeLog

Clearing review flag, because Larry is working on a patch which will fix this for all platforms.
Comment 8 Larry Ewing 2009-02-27 12:21:27 PST
Created attachment 28099 [details]
Patch for all platforms

Fix the NPBool values for all platforms and use c++ style casts
Comment 9 Alexey Proskuryakov 2009-03-01 05:47:55 PST
Comment on attachment 28099 [details]
Patch for all platforms

r=me

There are tabs in ChangeLog, they will need to be replaced with spaces when landing.
Comment 10 David Levin 2009-03-01 16:43:08 PST
Committed as r41346.