tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

commit c580162cc920c52ecdde1454e487ee03cb46948a
parent 9375ef01e534da18b375a99c99f651fb0343beeb
Author: alexical <dothayer@mozilla.com>
Date:   Thu, 16 Oct 2025 14:03:56 +0000

Bug 1992249 - Verify version when deserializing r=ochameau,devtools-reviewers

Differential Revision: https://phabricator.services.mozilla.com/D268006

Diffstat:
Mdevtools/client/shared/components/reps/reps/value-summary-reader.mjs | 14++++++++++++++
1 file changed, 14 insertions(+), 0 deletions(-)

diff --git a/devtools/client/shared/components/reps/reps/value-summary-reader.mjs b/devtools/client/shared/components/reps/reps/value-summary-reader.mjs @@ -6,6 +6,8 @@ const MAX_ARGUMENTS_TO_RECORD = 4; const ZERO_ARGUMENTS_MAGIC = -2; const EXPIRED_VALUES_MAGIC = -1; +const EXPECTED_VALUE_SUMMARIES_VERSION = 2; + const JSVAL_TYPE_DOUBLE = 0x00; const JSVAL_TYPE_INT32 = 0x01; const JSVAL_TYPE_BOOLEAN = 0x02; @@ -530,6 +532,12 @@ function readValueSummary(reader, depth, shapes) { } } +function bufferVersion(valuesBuffer) { + const reader = new BufferReader(valuesBuffer, 0); + const version = reader.readUint32(); + return version; +} + function getArgumentSummaries(valuesBuffer, shapes, valuesBufferIndex) { if (valuesBufferIndex === ZERO_ARGUMENTS_MAGIC) { return []; @@ -537,6 +545,12 @@ function getArgumentSummaries(valuesBuffer, shapes, valuesBufferIndex) { if (valuesBufferIndex === EXPIRED_VALUES_MAGIC) { return "<missing>"; } + const theirVersion = bufferVersion(valuesBuffer); + if (theirVersion != EXPECTED_VALUE_SUMMARIES_VERSION) { + throw new Error( + `Unexpected tracer arguments buffer format. Expected ${EXPECTED_VALUE_SUMMARIES_VERSION}, received ${theirVersion}.` + ); + } const reader = new BufferReader(valuesBuffer, valuesBufferIndex); const argc = reader.readUint32();