wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-23 08:57:34 +09:00
Code Issues Projects Releases Packages Wiki Activity

Bug 1333038 - Use 'modern' pointers to fix crash due to nsMsgLineStreamBuffer object being deleted while still in use.

Browse source 
Suspected "use after free" in nsMsgLineStreamBuffer::ReadNextLine() leading to crash since object may be destroyed while still in use on another thread.

Tag #1273
This commit is contained in:
Matt A. Tobin 2019-11-10 21:59:52 -05:00 • committed by Roy Tam
commit 14590876b2
13 changed files with 14 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

3
mailnews/imap/src/nsImapMailFolder.cpp
View file

@ -8379,7 +8379,7 @@ nsImapMailFolder::CopyFileToOfflineStore(nsIFile *srcFile, nsMsgKey msgKey)
{
// Now, parse the temp file to (optionally) copy to
// the offline store for the cur folder.
nsMsgLineStreamBuffer *inputStreamBuffer =
RefPtr<nsMsgLineStreamBuffer> inputStreamBuffer =
new nsMsgLineStreamBuffer(FILE_IO_BUFFER_SIZE, true, false);
int64_t fileSize;
srcFile->GetFileSize(&fileSize);
@ -8443,7 +8443,6 @@ nsImapMailFolder::CopyFileToOfflineStore(nsIFile *srcFile, nsMsgKey msgKey)
notifier->NotifyMsgsClassified(messages, false, false);
inputStream->Close();
inputStream = nullptr;
delete inputStreamBuffer;
}
if (offlineStore)
offlineStore->Close();

1
mailnews/imap/src/nsImapProtocol.cpp
View file

@ -586,7 +586,6 @@ nsImapProtocol::~nsImapProtocol()
NS_IF_RELEASE(m_flagState);
PR_Free(m_dataOutputBuf);
delete m_inputStreamBuffer;
// **** We must be out of the thread main loop function
NS_ASSERTION(!m_imapThreadIsRunning, "Oops, thread is still running.\n");

2
mailnews/imap/src/nsImapProtocol.h
View file

@ -323,7 +323,7 @@ private:
nsCString m_serverKey;
nsCString m_realHostName;
char *m_dataOutputBuf;
nsMsgLineStreamBuffer * m_inputStreamBuffer;
RefPtr<nsMsgLineStreamBuffer> m_inputStreamBuffer;
uint32_t m_allocatedSize; // allocated size
uint32_t m_totalDataSize; // total data size
uint32_t m_curReadIndex; // current read index

8
mailnews/imap/src/nsImapService.cpp
View file

@ -2061,9 +2061,10 @@ nsresult nsImapService::OfflineAppendFromFile(nsIFile *aFile,
if (NS_SUCCEEDED(rv) && inputStream)
{
// now, copy the temp file to the offline store for the dest folder.
nsMsgLineStreamBuffer *inputStreamBuffer = new nsMsgLineStreamBuffer(FILE_IO_BUFFER_SIZE,
true, // allocate new lines
false); // leave CRLFs on the returned string
RefPtr<nsMsgLineStreamBuffer> inputStreamBuffer =
new nsMsgLineStreamBuffer(FILE_IO_BUFFER_SIZE,
true, // allocate new lines
false); // leave CRLFs on the returned string
int64_t fileSize;
aFile->GetFileSize(&fileSize);
uint32_t bytesWritten;
@ -2109,7 +2110,6 @@ nsresult nsImapService::OfflineAppendFromFile(nsIFile *aFile,
inputStream->Close();
inputStream = nullptr;
aListener->OnStopRunningUrl(aUrl, NS_OK);
delete inputStreamBuffer;
}
offlineStore->Close();
}