From e32d5beb72befd4b4e22f464d8ab6ddbf08b69d2 Mon Sep 17 00:00:00 2001
From: Bastiaan Jacques <bastiaan@bjacques.org>
Date: Sun, 25 Mar 2012 22:40:10 +0000
Subject: Check that an NPVariant is an NPString before trying to use it as such. Bug #36002.

---
diff --git a/plugin/npapi/GnashNPVariant.h b/plugin/npapi/GnashNPVariant.h
index 6e4b1af..a0d37d4 100644
--- a/plugin/npapi/GnashNPVariant.h
+++ b/plugin/npapi/GnashNPVariant.h
@@ -89,6 +89,19 @@ NPStringToString(const NPString& str)
     return std::string(GetNPStringChars(str), GetNPStringLen(str));
 }
 
+/// Construct a std::string from an NPVariant.
+//
+/// @return a std::string containing the string value of the NPVariant, if it
+///         is an NPString; otherwise an empty string.
+inline std::string
+NPVariantToString(const NPVariant& val)
+{
+    if (!NPVARIANT_IS_STRING(val)) {
+        return std::string();
+    }
+
+    return NPStringToString(NPVARIANT_TO_STRING(val));
+}
 
 /// This class holds ownership of (a copy of) an NPVariant.
 //
diff --git a/plugin/npapi/plugin.cpp b/plugin/npapi/plugin.cpp
index 2cceee8..dc597f1 100644
--- a/plugin/npapi/plugin.cpp
+++ b/plugin/npapi/plugin.cpp
@@ -824,14 +824,12 @@ nsPluginInstance::processPlayerRequest()
             assert(invoke->args.size() > 1);
             
             // The first argument is the URL string.
-            std::string url = NPStringToString(NPVARIANT_TO_STRING(
-                                                   invoke->args[0].get()));
+            std::string url = NPVariantToString(invoke->args[0].get());
 #if 0
             gnash::log_debug("Got a getURL() request: %s", url);
 #endif
             // The second is the method, namely GET or POST.
-            std::string op = NPStringToString(NPVARIANT_TO_STRING(
-                                                  invoke->args[1].get()));
+            std::string op = NPVariantToString(invoke->args[1].get());
             // The third is the optional target, which is something like
             // _blank or _self.
             std::string target;
@@ -841,8 +839,7 @@ nsPluginInstance::processPlayerRequest()
             std::string data;
             
             if (invoke->args.size() >= 3) {
-                target = NPStringToString(NPVARIANT_TO_STRING(
-                                              invoke->args[2].get()));
+                target = NPVariantToString(invoke->args[2].get());
             }
             
             // An empty target defaults to "_self"
@@ -851,8 +848,7 @@ nsPluginInstance::processPlayerRequest()
             if ( target.empty() ) target = "_self";
             
             if (invoke->args.size() == 4) {
-                data = NPStringToString(NPVARIANT_TO_STRING(
-                                            invoke->args[3].get()));
+                data = NPVariantToString(invoke->args[3].get());
             }
             if (op == "GET") {
                 gnash::log_debug("Asked to getURL '%s' in target %s", url,
@@ -871,10 +867,8 @@ nsPluginInstance::processPlayerRequest()
         } else if (invoke->name == "fsCommand") {
             
             assert(invoke->args.size() > 1);
-            std::string command = NPStringToString(NPVARIANT_TO_STRING(
-                                                       invoke->args[0].get()));
-            std::string arg = NPStringToString(NPVARIANT_TO_STRING(
-                                                   invoke->args[1].get()));            
+            std::string command = NPVariantToString(invoke->args[0].get());
+            std::string arg = NPVariantToString(invoke->args[1].get());            
             std::string name = _name; 
             std::stringstream jsurl;
             jsurl << "javascript:" << name << "_DoFSCommand('" << command
@@ -900,8 +894,7 @@ nsPluginInstance::processPlayerRequest()
             // actual callback lives in libcore/movie_root, but it
             // needs to be on the list of supported remote methods so
             // it can be called by Javascript.
-            std::string method = NPStringToString(NPVARIANT_TO_STRING(
-                                                      invoke->args[0].get()));
+            std::string method = NPVariantToString(invoke->args[0].get());
             NPIdentifier id = NPN_GetStringIdentifier(method.c_str());
             // log_debug("SCRIPT OBJECT addMethod: %x, %s", (void *)_scriptObject, method);
             this->getScriptObject()->AddMethod(id, remoteCallback);
--
cgit v0.9.0.2