[Webkit-unassigned] [Bug 137425] Plugin process crashes in NPN_InvokeDefault

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Tue Nov 17 02:58:33 PST 2015


Carlos Garcia Campos <cgarcia at igalia.com> changed:

           What    |Removed                     |Added
             Status|RESOLVED                    |REOPENED
         Resolution|INVALID                     |---

--- Comment #3 from Carlos Garcia Campos <cgarcia at igalia.com> ---
I'm checking this, and I still think it's a bug in the plugin calling invokeDefault with a null NPObject, but we shouldn't trust plugins anyway. I think we should protect all public plugins api. Firefox seems to do something like this in invokeDefault, for example:

if (!npp || !npobj || !npobj->_class || !npobj->_class->invokeDefault)
    return false;

I think we could do something similar to what we do in retainNPObject, releaseNPObject, etc. Add ASSERTS to catch those issues in Debug builds, but also early returns to not crash in Release.

You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20151117/12d3f908/attachment.html>

More information about the webkit-unassigned mailing list