Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-09 11:25:00 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1306142 - Unchecked return code in U2F. r=keeler

Browse Source 
The U2F.cpp code fails to test all returns from CryptoBuffer.Assign(),
leading (when OOM) to potentially empty registration keys (during Register),
or empty attestations (during Sign).

This is a protocol violation, and forced testing at Dropbox,
u2fdemo.appspot.com, and u2f.bin.coffee show that those Relying Parties'
implementations properly error out if the registration or attestation is empty,
as would happen in this instance.

As this is only on an OOM condition, it's not really feasible to add an
automated test.

Also catches one other Assign() that isn't properly returning
"NS_ERROR_OUT_OF_MEMORY".
This commit is contained in:
J.C. Jones 2016-10-07 16:48:55 -07:00
parent a5b764f858
commit 91e424db5d
1 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
dom/u2f/U2F.cpp
View File

@ -70,7 +70,7 @@ AssembleClientData(const nsAString& aOrigin, const nsAString& aTyp,
}
if (NS_WARN_IF(!aClientData.Assign(NS_ConvertUTF16toUTF8(json)))) {
return NS_ERROR_FAILURE;
return NS_ERROR_OUT_OF_MEMORY;
}
return NS_OK;
@ -246,7 +246,12 @@ U2FRegisterTask::Run()
}
MOZ_ASSERT(buffer);
regData.Assign(buffer, bufferlen);
if (NS_WARN_IF(!regData.Assign(buffer, bufferlen))) {
free(buffer);
ReturnError(ErrorCode::OTHER_ERROR);
return NS_ERROR_OUT_OF_MEMORY;
}
free(buffer);
registerSuccess = true;
break;
@ -424,7 +429,12 @@ U2FSignTask::Run()
}
MOZ_ASSERT(buffer);
signatureData.Assign(buffer, bufferlen);
if (NS_WARN_IF(!signatureData.Assign(buffer, bufferlen))) {
free(buffer);
ReturnError(ErrorCode::OTHER_ERROR);
return NS_ERROR_OUT_OF_MEMORY;
}
free(buffer);
signSuccess = true;
}