Bug 1190020 - P1. Fix truncated hashes in application reputation remote lookups. r=francois
authorDimi <dimi@liweiguode-MacBook-Pro.local>
Fri, 19 Oct 2018 09:17:08 +0000
changeset 491010 ffb7704a1bf8af534306427755e18cfe4db8da62
parent 491009 59205b705c5cbba29276d8a342179ff0caebf071
child 491011 b872e2aa271c063a31219ee93455541198b99cbc
push id247
push userfmarier@mozilla.com
push dateSat, 27 Oct 2018 01:06:44 +0000
reviewersfrancois
bugs1190020
milestone65.0a1
Bug 1190020 - P1. Fix truncated hashes in application reputation remote lookups. r=francois When we set the remote lookup digest, we get char* from nsCString and convert char* to std::string without specifying size. If SHA256 data contains '00', std::string treats it as a null terminated sting so we have a shorter SHA256. This patch fixes this issue by specifying the size when converting char* to std::string. Differential Revision: https://phabricator.services.mozilla.com/D8830
toolkit/components/reputationservice/ApplicationReputation.cpp
--- a/toolkit/components/reputationservice/ApplicationReputation.cpp
+++ b/toolkit/components/reputationservice/ApplicationReputation.cpp
@@ -1466,17 +1466,18 @@ PendingLookup::SendRemoteQueryInternal()
 
   nsCString locale;
   rv = LocaleService::GetInstance()->GetAppLocaleAsLangTag(locale);
   NS_ENSURE_SUCCESS(rv, rv);
   mRequest.set_locale(locale.get());
   nsCString sha256Hash;
   rv = mQuery->GetSha256Hash(sha256Hash);
   NS_ENSURE_SUCCESS(rv, rv);
-  mRequest.mutable_digests()->set_sha256(sha256Hash.Data());
+  mRequest.mutable_digests()->set_sha256(
+    std::string(sha256Hash.Data(), sha256Hash.Length()));
   mRequest.set_file_basename(mFileName.get());
   mRequest.set_download_type(GetDownloadType(mFileName));
 
   if (mRequest.signature().trusted()) {
     LOG(("Got signed binary for remote application reputation check "
          "[this = %p]", this));
   } else {
     LOG(("Got unsigned binary for remote application reputation check "