aniani/elinks
1
0
Fork 0
mirror of https://github.com/rkd77/elinks.git synced 2024-10-02 03:46:21 -04:00
Code

Bug 846: {get,set}Property check JS_InstanceOf without asserting.

Browse Source 
The getProperty and setProperty functions of a JSClass must not assume
that the obj parameter points to an instance of that class.  It might
instead point to another object that merely has an instance of the
class in its prototype chain.  Thus, do not assert that JS_InstanceOf
returns true there.  Instead, run the check even with CONFIG_FASTMEM,
and just return JS_FALSE if it fails.

(Adapted from aa410301f1 in ELinks 0.12.GIT.)
This commit is contained in:
Kalle Olavi Niemitalo 2006-12-03 11:14:22 +02:00 committed by Kalle Olavi Niemitalo
parent 5b9ea6a4ee
commit aac8f4582f
9 changed files with 117 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/ecmascript/spidermonkey/document.c
View File

@ -80,8 +80,11 @@ document_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
struct document *document;
struct session *ses;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &document_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of the
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &document_class, NULL))
return JS_FALSE;
parent_win = JS_GetParent(ctx, obj);
assert(JS_InstanceOf(ctx, parent_win, (JSClass *) &window_class, NULL));
if_assert_failed return JS_FALSE;
@ -174,8 +177,11 @@ document_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
struct document_view *doc_view;
struct document *document;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &document_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of the
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &document_class, NULL))
return JS_FALSE;
parent_win = JS_GetParent(ctx, obj);
assert(JS_InstanceOf(ctx, parent_win, (JSClass *) &window_class, NULL));
if_assert_failed return JS_FALSE;

42
src/ecmascript/spidermonkey/form.c
View File

@ -136,8 +136,11 @@ input_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
int linknum;
struct link *link = NULL;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &input_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of the
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &input_class, NULL))
return JS_FALSE;
parent_form = JS_GetParent(ctx, obj);
assert(JS_InstanceOf(ctx, parent_form, (JSClass *) &form_class, NULL));
if_assert_failed return JS_FALSE;
@ -267,8 +270,11 @@ input_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
int linknum;
struct link *link = NULL;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &input_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of the
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &input_class, NULL))
return JS_FALSE;
parent_form = JS_GetParent(ctx, obj);
assert(JS_InstanceOf(ctx, parent_form, (JSClass *) &form_class, NULL));
if_assert_failed return JS_FALSE;
@ -552,8 +558,11 @@ form_elements_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
struct form_view *form_view;
struct form *form;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &form_elements_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of the
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &form_elements_class, NULL))
return JS_FALSE;
parent_form = JS_GetParent(ctx, obj);
assert(JS_InstanceOf(ctx, parent_form, (JSClass *) &form_class, NULL));
if_assert_failed return JS_FALSE;
@ -759,8 +768,11 @@ form_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
struct form_view *fv;
struct form *form;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &form_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of the
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &form_class, NULL))
return JS_FALSE;
parent_doc = JS_GetParent(ctx, obj);
assert(JS_InstanceOf(ctx, parent_doc, (JSClass *) &document_class, NULL));
if_assert_failed return JS_FALSE;
@ -881,8 +893,11 @@ form_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
struct form *form;
unsigned char *string;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &form_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of the
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &form_class, NULL))
return JS_FALSE;
parent_doc = JS_GetParent(ctx, obj);
assert(JS_InstanceOf(ctx, parent_doc, (JSClass *) &document_class, NULL));
if_assert_failed return JS_FALSE;
@ -1064,8 +1079,11 @@ forms_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
struct document_view *doc_view;
struct document *document;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &forms_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of the
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &forms_class, NULL))
return JS_FALSE;
parent_doc = JS_GetParent(ctx, obj);
assert(JS_InstanceOf(ctx, parent_doc, (JSClass *) &document_class, NULL));
if_assert_failed return JS_FALSE;

14
src/ecmascript/spidermonkey/location.c
View File

@ -149,8 +149,11 @@ location_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
JSObject *parent_win; /* instance of @window_class */
struct view_state *vs;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &location_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of the
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &location_class, NULL))
return JS_FALSE;
parent_win = JS_GetParent(ctx, obj);
assert(JS_InstanceOf(ctx, parent_win, (JSClass *) &window_class, NULL));
if_assert_failed return JS_FALSE;
@ -182,8 +185,11 @@ location_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
struct view_state *vs;
struct document_view *doc_view;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &location_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of the
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &location_class, NULL))
return JS_FALSE;
parent_win = JS_GetParent(ctx, obj);
assert(JS_InstanceOf(ctx, parent_win, (JSClass *) &window_class, NULL));
if_assert_failed return JS_FALSE;

18
src/ecmascript/spidermonkey/unibar.c
View File

@ -82,9 +82,12 @@ unibar_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
struct session_status *status;
unsigned char *bar;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &menubar_class, NULL)
|| JS_InstanceOf(ctx, obj, (JSClass *) &statusbar_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of either
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &menubar_class, NULL)
&& !JS_InstanceOf(ctx, obj, (JSClass *) &statusbar_class, NULL))
return JS_FALSE;
parent_win = JS_GetParent(ctx, obj);
assert(JS_InstanceOf(ctx, parent_win, (JSClass *) &window_class, NULL));
if_assert_failed return JS_FALSE;
@ -134,9 +137,12 @@ unibar_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
struct session_status *status;
unsigned char *bar;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &menubar_class, NULL)
|| JS_InstanceOf(ctx, obj, (JSClass *) &statusbar_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of either
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &menubar_class, NULL)
&& !JS_InstanceOf(ctx, obj, (JSClass *) &statusbar_class, NULL))
return JS_FALSE;
parent_win = JS_GetParent(ctx, obj);
assert(JS_InstanceOf(ctx, parent_win, (JSClass *) &window_class, NULL));
if_assert_failed return JS_FALSE;

14
src/ecmascript/spidermonkey/window.c
View File

@ -120,8 +120,11 @@ window_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
{
struct view_state *vs;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &window_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of the
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &window_class, NULL))
return JS_FALSE;
vs = JS_GetPrivate(ctx, obj); /* from @window_class */
@ -242,8 +245,11 @@ window_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
{
struct view_state *vs;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &window_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of the
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &window_class, NULL))
return JS_FALSE;
vs = JS_GetPrivate(ctx, obj); /* from @window_class */

21
src/scripting/smjs/bookmarks.c
View File

@ -80,8 +80,11 @@ bookmark_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
{
struct bookmark *bookmark;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &bookmark_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of the
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &bookmark_class, NULL))
return JS_FALSE;
bookmark = JS_GetPrivate(ctx, obj); /* from @bookmark_class */
@ -121,8 +124,11 @@ bookmark_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
{
struct bookmark *bookmark;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &bookmark_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of the
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &bookmark_class, NULL))
return JS_FALSE;
bookmark = JS_GetPrivate(ctx, obj); /* from @bookmark_class */
@ -191,8 +197,11 @@ bookmark_folder_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
struct bookmark *folder;
unsigned char *title;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &bookmark_folder_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of the
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &bookmark_folder_class, NULL))
return JS_FALSE;
folder = JS_GetPrivate(ctx, obj); /* from @bookmark_folder_class */

14
src/scripting/smjs/cache_object.c
View File

@ -39,8 +39,11 @@ cache_entry_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
{
struct cache_entry *cached;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &cache_entry_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of the
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &cache_entry_class, NULL))
return JS_FALSE;
cached = JS_GetPrivate(ctx, obj); /* from @cache_entry_class */
@ -96,8 +99,11 @@ cache_entry_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
{
struct cache_entry *cached;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &cache_entry_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of the
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &cache_entry_class, NULL))
return JS_FALSE;
cached = JS_GetPrivate(ctx, obj); /* from @cache_entry_class */

14
src/scripting/smjs/keybinding.c
View File

@ -23,8 +23,11 @@ keymap_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
unsigned char *keystroke_str;
int *data;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &keymap_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of the
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &keymap_class, NULL))
return JS_FALSE;
data = JS_GetPrivate(ctx, obj); /* from @keymap_class */
@ -74,8 +77,11 @@ keymap_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
unsigned char *keymap_str;
unsigned char *keystroke_str;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &keymap_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of the
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &keymap_class, NULL))
return JS_FALSE;
data = JS_GetPrivate(ctx, obj); /* from @keymap_class */

14
src/scripting/smjs/view_state_object.c
View File

@ -35,8 +35,11 @@ view_state_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
{
struct view_state *vs;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &view_state_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of the
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &view_state_class, NULL))
return JS_FALSE;
vs = JS_GetPrivate(ctx, obj); /* from @view_state_class */
@ -69,8 +72,11 @@ view_state_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
{
struct view_state *vs;
assert(JS_InstanceOf(ctx, obj, (JSClass *) &view_state_class, NULL));
if_assert_failed return JS_FALSE;
/* This can be called if @obj if not itself an instance of the
* appropriate class but has one in its prototype chain. Fail
* such calls. */
if (!JS_InstanceOf(ctx, obj, (JSClass *) &view_state_class, NULL))
return JS_FALSE;
vs = JS_GetPrivate(ctx, obj); /* from @view_state_class */