Launchpad has imported 1 comments from the remote bug at
http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=2714.

If you reply to an imported comment from within Launchpad, your comment
will be sent to the remote bug automatically. Read more about
Launchpad's inter-bugtracker facilities at
https://help.launchpad.net/InterBugTracking.

------------------------------------------------------------------------
On 2015-11-13T13:30:29+00:00 Tiago Stürmer Daitx wrote:

Created attachment 1445
handle error when NPN_GetValueForURL call fails

Original bug report: https://bugs.launchpad.net/ubuntu/+source/icedtea-
web/+bug/1222912

Here's the real issue, one call further in, in the get_proxy_info
function:

      gpointer instance=getFirstInTableInstance(instance_to_id_map);
      browser_functions.getvalueforurl((NPP) instance, NPNURLVProxy, siteAddr, 
proxy, len);

looking at the docs for that function (NPN_GetValueForURL), the
signature is:

NPError NPN_GetValueForURL(NPP instance, NPNURLVariable variable, const
char *url, char **value, uint32_t *len);

and an important point called out for the value parameter:

*Note: the value may have internal NULL bytes and may not be NULL-
terminated.*

importantly, neither the return value nor len are actually checked
before moving on and attempting to use the value.

When Firefox is set to use a PAC file that doesn't exist, the function
call fails, no allocation happens for **value (leaving whatever garbage
was in memory before), len is set to 0, but IcedTea disregards that and
continues on as though it succeeded, and concatenates random memory
garbage to the plugin PluginProxyInfo string that is to be sent over to
the java process.

Back in the previous function call, it is enough to work around the bug
by changing gchar* proxy; to gchar* proxy = NULL;, but it is perhaps
only partially correct. Attached here is a patch that resolves the issue
in my case.

Reply at: https://bugs.launchpad.net/ubuntu/+source/icedtea-
web/+bug/1222912/comments/7


** Changed in: icedtea
       Status: Unknown => Confirmed

** Changed in: icedtea
   Importance: Unknown => Wishlist

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1222912

Title:
  Error parsing proxy.pac

To manage notifications about this bug go to:
https://bugs.launchpad.net/icedtea/+bug/1222912/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to