132862 - wrong mem check after allocation in nsMsgDBView.cpp

Status: VERIFIED FIXED

(MailNews Core :: Database, defect)

Description

[Frank Tang]

I found some wrong null pointer check after allocation in nsMsgDBView.cpp
this could lead to crash when we are in memory pressure

I. 

1665   *indices = (nsMsgViewIndex *)nsMemory::Alloc(numIndicies *
sizeof(nsMsgViewIndex));
1666   if (!indices) return NS_ERROR_OUT_OF_MEMORY;

line 1666 should be
1666   if (!(*indices)) return NS_ERROR_OUT_OF_MEMORY;
since the allocate return to *indicies instead of indicies

II. 
there are no checking of null in 
4922       PRInt32 *startRangeArray = (PRInt32*) PR_MALLOC(selectionCount*
sizeof(PRInt32));
4923       PRInt32 *endRangeArray = (PRInt32*) PR_MALLOC(selectionCount*
sizeof(PRInt32));

you should add
NS_ASSERTION(startRangeArray, "cannot allocate startRangeArray");
NS_ASSERTION(endRangeArray, "cannot allocate startRangeArray");

and also handle the case if either of them are null
cvsblame show the first one is mscott and the 2nd one is naving, assign to
mscott and cc naving

Comment 1

[Henrik Gemal]

I think II changed but issue I is still valid. will provide patch

Comment 2

[Henrik Gemal]

Attachment: patch to fix issue

I haven't tested the patch but it should work

Comment 3

[David :Bienvenu]

Comment on attachment 132732 [details] [diff] [review]
patch to fix issue

r=bienvenu, thx

Comment 4

[Henrik Gemal]

Comment on attachment 132732 [details] [diff] [review]
patch to fix issue

If sr= is given could someone please checkin since I dont have CVS access

Comment 5

[Henrik Gemal]

taking bug

Comment 6

[Henrik Gemal]

Comment on attachment 132732 [details] [diff] [review]
patch to fix issue

please also do the checkin if sr=

Comment 7

[Henrik Gemal]

Comment on attachment 132732 [details] [diff] [review]
patch to fix issue

I'm told that you can also do sr= if the patch is small? Please also check in

Comment 8

[David :Bienvenu]

I've taken care of it, thx.

Comment 9

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified fixed using LXR as code inspection (as well as my local source tree).