зеркало из https://github.com/mozilla/gecko-dev.git
4641d9bef3
We were calling XML_GetCurrentColumnNumber after ParseBuffer caused Expat to consume some data. XML_GetCurrentColumnNumber uses the buffer that was last passed to Expat. Before Expat was put in an RLBox sandbox the caller of ParseBuffer would keep the data in the scanner string until after the call to XML_GetCurrentColumnNumber. Now that we copy the data into the RLBox sandbox the data is freed when the TransferBuffer in ParseBuffer goes out of scope, so in the caller of ParseBuffer the call to XML_GetCurrentColumnNumber would cause us to read freed memory inside the sandbox. Moving the call to XML_GetCurrentColumnNumber to inside ParseBuffer, when TransferBuffer is still in scope, solves the issue. Differential Revision: https://phabricator.services.mozilla.com/D141795 |
||
|---|---|---|
| .. | ||
| tests | ||
| CNavDTD.cpp | ||
| CNavDTD.h | ||
| CParserContext.cpp | ||
| CParserContext.h | ||
| moz.build | ||
| nsElementTable.cpp | ||
| nsElementTable.h | ||
| nsExpatDriver.cpp | ||
| nsExpatDriver.h | ||
| nsHTMLTagList.h | ||
| nsHTMLTags.cpp | ||
| nsHTMLTags.h | ||
| nsIContentSink.h | ||
| nsIDTD.h | ||
| nsIExpatSink.idl | ||
| nsIFragmentContentSink.h | ||
| nsIHTMLContentSink.h | ||
| nsIParser.h | ||
| nsParser.cpp | ||
| nsParser.h | ||
| nsParserBase.h | ||
| nsParserConstants.h | ||
| nsParserMsgUtils.cpp | ||
| nsParserMsgUtils.h | ||
| nsRLBoxExpatDriver.h | ||
| nsScanner.cpp | ||
| nsScanner.h | ||
| nsScannerString.cpp | ||
| nsScannerString.h | ||