firefox/CVE-2020-15664.patch

35 lines
1.3 KiB
Diff

# HG changeset patch
# User Kris Maglione <maglione.k@gmail.com>
# Date 1597420945 0
# Fri Aug 14 16:02:25 2020 +0000
# Node ID 1edd9346c110b011ed87e50eb3d417202ea445fb
# Parent f69f80e5659f11977e7f1bd48386ea22e921dd52
Bug 1658214: Only construct JS-implemented objects if inner window is current. r=bholley
Differential Revision: https://phabricator.services.mozilla.com/D86614
diff -r f69f80e5659f -r 1edd9346c110 dom/bindings/BindingUtils.cpp
--- a/dom/bindings/BindingUtils.cpp Fri Aug 14 15:57:45 2020 +0000
+++ b/dom/bindings/BindingUtils.cpp Fri Aug 14 16:02:25 2020 +0000
@@ -2547,6 +2547,12 @@
{
AutoNoJSAPI nojsapi;
+ nsCOMPtr<nsPIDOMWindowInner> window = do_QueryInterface(aGlobal);
+ if (!window->IsCurrentInnerWindow()) {
+ aRv.ThrowInvalidStateError("Window no longer active");
+ return;
+ }
+
// Get the XPCOM component containing the JS implementation.
nsresult rv;
nsCOMPtr<nsISupports> implISupports = do_CreateInstance(aContractId, &rv);
@@ -2561,7 +2567,6 @@
// and our global is a window.
nsCOMPtr<nsIDOMGlobalPropertyInitializer> gpi =
do_QueryInterface(implISupports);
- nsCOMPtr<nsPIDOMWindowInner> window = do_QueryInterface(aGlobal);
if (gpi) {
JS::Rooted<JS::Value> initReturn(RootingCx());
rv = gpi->Init(window, &initReturn);