mirror of
https://git.FreeBSD.org/ports.git
synced 2024-12-19 03:52:17 +00:00
e33b416ed3
CVE-2009-1834 CVE-2009-1835 CVE-2009-1836 CVE-2009-1838 CVE-2009-1841 Obtained from: Mozilla Bugzilla Security: http://www.vuxml.org/freebsd/da185955-5738-11de-b857-000f20797ede.html With hat: Gecko gang
70 lines
2.6 KiB
Plaintext
70 lines
2.6 KiB
Plaintext
diff -up mozilla/js/src/xpconnect/src/xpcprivate.h.479560 mozilla/js/src/xpconnect/src/xpcprivate.h
|
|
--- js/src/xpconnect/src/xpcprivate.h.479560 2008-03-22 09:04:17.000000000 +0100
|
|
+++ js/src/xpconnect/src/xpcprivate.h 2009-05-13 14:56:10.000000000 +0200
|
|
@@ -2167,7 +2167,7 @@ private:
|
|
nsXPCWrappedJSClass(XPCCallContext& ccx, REFNSIID aIID,
|
|
nsIInterfaceInfo* aInfo);
|
|
|
|
- JSObject* NewOutObject(JSContext* cx);
|
|
+ JSObject* NewOutObject(JSContext* cx, JSObject* scope);
|
|
|
|
JSBool IsReflectable(uint16 i) const
|
|
{return (JSBool)(mDescriptors[i/32] & (1 << (i%32)));}
|
|
diff -up mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp.479560 mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp
|
|
--- js/src/xpconnect/src/xpcwrappedjsclass.cpp.479560 2007-06-30 01:21:28.000000000 +0200
|
|
+++ js/src/xpconnect/src/xpcwrappedjsclass.cpp 2009-05-13 14:51:35.000000000 +0200
|
|
@@ -1338,7 +1338,7 @@ nsXPCWrappedJSClass::CallMethod(nsXPCWra
|
|
if(param.IsOut())
|
|
{
|
|
// create an 'out' object
|
|
- JSObject* out_obj = NewOutObject(cx);
|
|
+ JSObject* out_obj = NewOutObject(cx, obj);
|
|
if(!out_obj)
|
|
{
|
|
retval = NS_ERROR_OUT_OF_MEMORY;
|
|
@@ -1706,9 +1706,9 @@ nsXPCWrappedJSClass::GetInterfaceName()
|
|
}
|
|
|
|
JSObject*
|
|
-nsXPCWrappedJSClass::NewOutObject(JSContext* cx)
|
|
+nsXPCWrappedJSClass::NewOutObject(JSContext* cx, JSObject* scope)
|
|
{
|
|
- return JS_NewObject(cx, nsnull, nsnull, nsnull);
|
|
+ return JS_NewObject(cx, nsnull, nsnull, JS_GetGlobalForObject(cx, scope));
|
|
}
|
|
|
|
|
|
diff -up mozilla/js/src/jsapi.c.old mozilla/js/src/jsapi.c
|
|
--- js/src/jsapi.c.old 2009-05-13 15:13:20.000000000 +0200
|
|
+++ js/src/jsapi.c 2009-05-13 15:13:32.000000000 +0200
|
|
@@ -122,6 +122,16 @@ JS_GetPositiveInfinityValue(JSContext *c
|
|
return DOUBLE_TO_JSVAL(cx->runtime->jsPositiveInfinity);
|
|
}
|
|
|
|
+JS_PUBLIC_API(JSObject *)
|
|
+JS_GetGlobalForObject(JSContext *cx, JSObject *obj)
|
|
+{
|
|
+ JSObject *parent;
|
|
+
|
|
+ while ((parent = OBJ_GET_PARENT(cx, obj)) != NULL)
|
|
+ obj = parent;
|
|
+ return obj;
|
|
+}
|
|
+
|
|
JS_PUBLIC_API(jsval)
|
|
JS_GetEmptyStringValue(JSContext *cx)
|
|
{
|
|
diff -up mozilla/js/src/jsapi.h.old mozilla/js/src/jsapi.h
|
|
--- js/src/jsapi.h.old 2009-05-13 15:13:20.000000000 +0200
|
|
+++ js/src/jsapi.h 2009-05-13 15:13:32.000000000 +0200
|
|
@@ -668,6 +668,9 @@ JS_DumpNamedRoots(JSRuntime *rt,
|
|
void *data);
|
|
#endif
|
|
|
|
+extern JS_PUBLIC_API(JSObject *)
|
|
+JS_GetGlobalForObject(JSContext *cx, JSObject *obj);
|
|
+
|
|
/*
|
|
* Call JS_MapGCRoots to map the GC's roots table using map(rp, name, data).
|
|
* The root is pointed at by rp; if the root is unnamed, name is null; data is
|