Merge branch 'waterfox-bump' into 'master'

wf 2021.07 rpm

See merge request bgstack15/stackrpms!250

1 files changed, 0 insertions, 56 deletions

diff --git a/waterfox/mozilla-1436242.patch b/waterfox/mozilla-1436242.patch
deleted file mode 100644
index 570b7c5..0000000
--- a/waterfox/mozilla-1436242.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-
-# HG changeset patch
-# User Jed Davis <jld@mozilla.com>
-# Date 1526943705 21600
-# Node ID 6bb3adfa15c6877f7874429462dad88f8c978c4f
-# Parent  4c71c8454879c841871ecf3afb7dbdc96bad97fc
-Bug 1436242 - Avoid undefined behavior in IPC fd-passing code.  r=froydnj
-
-MozReview-Commit-ID: 3szIPUssgF5
-
-diff --git a/ipc/chromium/src/chrome/common/ipc_channel_posix.cc b/ipc/chromium/src/chrome/common/ipc_channel_posix.cc
---- a/ipc/chromium/src/chrome/common/ipc_channel_posix.cc
-+++ b/ipc/chromium/src/chrome/common/ipc_channel_posix.cc
-@@ -418,20 +418,37 @@ bool Channel::ChannelImpl::ProcessIncomi
-     const int* fds;
-     unsigned num_fds;
-     unsigned fds_i = 0;  // the index of the first unused descriptor
- 
-     if (input_overflow_fds_.empty()) {
-       fds = wire_fds;
-       num_fds = num_wire_fds;
-     } else {
--      const size_t prev_size = input_overflow_fds_.size();
--      input_overflow_fds_.resize(prev_size + num_wire_fds);
--      memcpy(&input_overflow_fds_[prev_size], wire_fds,
--             num_wire_fds * sizeof(int));
-+      // This code may look like a no-op in the case where
-+      // num_wire_fds == 0, but in fact:
-+      //
-+      // 1. wire_fds will be nullptr, so passing it to memcpy is
-+      // undefined behavior according to the C standard, even though
-+      // the memcpy length is 0.
-+      //
-+      // 2. prev_size will be an out-of-bounds index for
-+      // input_overflow_fds_; this is undefined behavior according to
-+      // the C++ standard, even though the element only has its
-+      // pointer taken and isn't accessed (and the corresponding
-+      // operation on a C array would be defined).
-+      //
-+      // UBSan makes #1 a fatal error, and assertions in libstdc++ do
-+      // the same for #2 if enabled.
-+      if (num_wire_fds > 0) {
-+        const size_t prev_size = input_overflow_fds_.size();
-+        input_overflow_fds_.resize(prev_size + num_wire_fds);
-+        memcpy(&input_overflow_fds_[prev_size], wire_fds,
-+               num_wire_fds * sizeof(int));
-+      }
-       fds = &input_overflow_fds_[0];
-       num_fds = input_overflow_fds_.size();
-     }
- 
-     // The data for the message we're currently reading consists of any data
-     // stored in incoming_message_ followed by data in input_buf_ (followed by
-     // other messages).
- 
-