[Webkit-unassigned] [Bug 137425] Plugin process crashes in NPN_InvokeDefault

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=137425

Carlos Garcia Campos <cgarcia at igalia.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
         Resolution|INVALID                     |---

--- Comment #3 from Carlos Garcia Campos <cgarcia at igalia.com> ---
I'm checking this, and I still think it's a bug in the plugin calling invokeDefault with a null NPObject, but we shouldn't trust plugins anyway. I think we should protect all public plugins api. Firefox seems to do something like this in invokeDefault, for example:

if (!npp || !npobj || !npobj->_class || !npobj->_class->invokeDefault)
    return false;

I think we could do something similar to what we do in retainNPObject, releaseNPObject, etc. Add ASSERTS to catch those issues in Debug builds, but also early returns to not crash in Release.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20151117/12d3f908/attachment.html>