Security fixes for Mozilla

[Dave Yeo]

I've been experimenting with porting security fixes from tenfourfox, a Firefox fork for PowerPC Macs that was also forked from 45ESR. Currently at about 50 changesets, over a 100 security issues patched I believe. For testing I've uploaded,
https://bitbucket.org/dryeo/mozilla-os2/downloads/firefox-45.9.0.en-US.os2-Pentium-m-SUa1.zip which also has unofficial branding instead of nightly.
https://bitbucket.org/dryeo/dry-comm-esr31/downloads/thunderbird-45.8.0.en-US.os2-Pentium-m-SUa1.zip and
https://bitbucket.org/dryeo/dry-comm-esr31/downloads/seamonkey-2.42.9esr.en-US.os2-Pentium-M-SUa1.zip

Don't forget to turn off mozturbo before updating and marking DLLs to load high. Should only use the latest release RPM's

[Doug Clark]

Thanks Dave,

Please remind me how to mark DLLs to load high.

[Dave Yeo]

Install the highmem package with Yum or ANPM. then in your program directory, after stopping ffturbo (ffturbo -u),

Code: [Select]

highmem -c *.dll then restart ffturbo or reboot.

[Doug Clark]

Thanks.

Very nice. I notice this version does not have the pesky "It looks like you haven't started Firefox in a while" message at the bottom. Thanks for your work on this.

[David McKenna]

 Thanks Dave! SeaMonkey working great here....

[Neil Waldhauer]

This is regarding the 4/4 version of Firefox. I'll get up to testing the more recent build shortly.

Firefox does not seem to start by itself. If I put firefox into Internet Application Integration so that I can launch web URL objects, or open a web page from Thunderbird, that does not work until I install Run!

The bitwise port starts without any help from Run!

[Dave Yeo]

This is regarding the 4/4 version of Firefox. I'll get up to testing the more recent build shortly.

Firefox does not seem to start by itself. If I put firefox into Internet Application Integration so that I can launch web URL objects, or open a web page from Thunderbird, that does not work until I install Run!

The bitwise port starts without any help from Run!

Strange. I just used IAI to make Firefox (one I just built using the full path to it) the default web browser application and opening a web page from Thunderbird changed to Firefox from the previous SeaMonkey as expected.
Clicking on a web URL object such as blonde guy still opened SeaMonkey, opening the properties, showed under Browser, D:\Programs\seamonkey\seamonkey!lk.exe which is why it kept using SeaMonkey, without the --no-remote parameter, the browser, even the older SM, just opens a new window in the running browser. I assume if I did not have SM already running, it would have opened the older browser that the URL object points to.
Not the best way to set things up in my opinion and likely the reason that IAI doesn't seem to work for the system installed URL objects.
Thunderbird, I'm not sure about though there was an issue on the Arca issue tracker where some one had a similar problem with the Bitwise build of Firefox, he finally worked around the issue by setting up Thunderbird to use Firefox directly.
There's no code changes between the Bitwise build and the one you're using.

[Dariusz Piatkowski]

Hey Dave!

I've been experimenting with porting security fixes from tenfourfox, a Firefox fork for PowerPC Macs that was also forked from 45ESR. Currently at about 50 changesets, over a 100 security issues patched I believe. For testing I've uploaded,
https://bitbucket.org/dryeo/mozilla-os2/downloads/firefox-45.9.0.en-US.os2-Pentium-m-SUa1.zip which also has unofficial branding instead of nightly...

So I wanted to give this drop a whirl, unpacking to a clean dir and attempting to run produced the following trap:

Code: [Select]

______________________________________________________________________
 Exception Report - created 2019/04/18 20:24:54
______________________________________________________________________
 OS2/eCS Version:  2.45
 # of Processors:  5
 Physical Memory:  3327 mb
 Virt Addr Limit:  2560 mb
 Exceptq Version:  7.11.3-shl (Jul  5 2016)
______________________________________________________________________
 Exception C0000005 - Access Violation
______________________________________________________________________
 Process:  G:\APPS\TCPIP\FIREFOX\FIREFOX.EXE (04/13/2019 15:32:15 282,117)
 PID:      144 (324)
 TID:      01 (1)
 Slot:     AB (171)
 Priority: 200

 Module:   N/A
 Filename: N/A
 Cause:    Invalid execution address 00020CBE
______________________________________________________________________
 Registers
______________________________________________________________________
 EAX : 00000008   EBX  : 0019F844   ECX : 00000002   EDX  : 0019FF4C
 ESI : 0019F948   EDI  : 18A68C54
 ESP : 0019F820   EBP  : 0019FA4C   EIP : 00020CBE   EFLG : 00010206
 CS  : 005B       CSLIM: FFFFFFFF   SS  : 0053       SSLIM: FFFFFFFF

 EAX : not a valid address
 EBX : read/write memory on this thread's stack
 ECX : not a valid address
 EDX : read/write memory on this thread's stack
 ESI : read/write memory on this thread's stack
 EDI : read/write memory at 0003:00008C54 in LIBCN0
______________________________________________________________________
 Stack Info for Thread 01
______________________________________________________________________
   Size       Base        ESP         Max         Top
 00100000   001A0000 -> 0019F820 -> 0018F000 -> 000A0000
______________________________________________________________________
 Call Stack
______________________________________________________________________
   EBP     Address    Module     Obj:Offset    Nearest Public Symbol
 --------  ---------  --------  -------------  -----------------------
 Trap  ->  00020CBE   Invalid address: 00020CBE

I've attached the full trp file below.

Did not re-boot, but the ffturbo was killed and no DLL remainder in memory.

[Dariusz Piatkowski]

Well, a re-boot later (probably should have done that to start off with, just to be sure) the browser does come up, but traps on the very last steps of loading any sites (tried several, including this forum).

Dave, I want to say this is very similar to something we hit when you built the AMD PhenomII version...does that ring any bells for you?

[Dave Yeo]

It's a crash that is usually triggered by badly written web sites, I found one through a bug that produced very similar trps the other day. Why it is happening consistently for you I don't know. Have you tried safe mode and/or a new profile? Hopefully that first trp, which I've never seen the like of, didn't screw something in your profile. Always a good idea to back up the profile before experimenting, something I should stress more.

[Dave Yeo]

Well, a re-boot later (probably should have done that to start off with, just to be sure) the browser does come up, but traps on the very last steps of loading any sites (tried several, including this forum).

Dave, I want to say this is very similar to something we hit when you built the AMD PhenomII version...does that ring any bells for you?

Had a similar trp, reproducible on certain sites, with the SUa1 builds, now fixed for SUa2.

[Dave Yeo]

As some have noticed, I've uploaded the SUa2 builds, both i686 and Pentium-m builds of Firefox (nightly), SeaMonkey and Thunderbird, all on my Bitbucket pages.
Fixed the crash that some web pages triggered. Fixed loading the Amtrak web site.
Added a bunch of security certificates and pins, bring it to the same level as the last release of 52ESR, this meant re-adding the NSS and NSPR libraries as updating the RPMs broke Firefox 38 etc.
Due to this there is also a new release of mozturbo which also includes a script to mark the DLLs and create program objects, thanks to André Heldoorn for the script. Also some icons, thanks to David Graser. The icons have to be associated manually for now.

[Pete]

Hi Dave

As some have noticed, I've uploaded the SUa2 builds, both i686 and Pentium-m builds of Firefox (nightly), SeaMonkey and Thunderbird, all on my Bitbucket pages.

All I see at https://bitbucket.org/dryeo/mozilla-os2/downloads/ are firefox and ffmpeg packages. Am I looking at the correct url?


Regards

Pete

[Dave Yeo]

https://bitbucket.org/dryeo/mozilla-os2/downloads/firefox-45.9.0.en-US.os2-Pentium-m-SUa2.zip They're packaged as Firefox but have the nightly theme.

[Eugene Tucker]

Is the Mozturbo new version released yet?