204067 - Creating "@mozilla.org/nsCMSEncoder;1" and then deleting it crashes because m_ecx isn't initialized

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect)

Description

[timeless]

./run-mozilla.sh ./xpcshell
Components.classes["@mozilla.org/nsCMSEncoder;1"].createInstance()
quit()

Program received signal SIGSEGV, Segmentation fault.
0x40426108 in NSS_CMSEncoder_Cancel () from ./libsmime3.so
(gdb) where
#0  0x40426108 in NSS_CMSEncoder_Cancel () from ./libsmime3.so
#1  0x403f8aa0 in nsCMSEncoder::destructorSafeDestroyNSSReference (
    this=0x810f388)
    at /mnt/ibm/mozhack/mozilla/security/manager/ssl/src/nsCMS.cpp:883
#2  0x403f89ca in nsCMSEncoder::~nsCMSEncoder (this=0x810f388, __in_chrg=3)
    at /mnt/ibm/mozhack/mozilla/security/manager/ssl/src/nsCMS.cpp:867
#3  0x403f8856 in nsCMSEncoder::Release (this=0x810f388)
    at /mnt/ibm/mozhack/mozilla/security/manager/ssl/src/nsCMS.cpp:855

(gdb) up
#1  0x403f8aa0 in nsCMSEncoder::destructorSafeDestroyNSSReference (
    this=0x810f388)
    at /mnt/ibm/mozhack/mozilla/security/manager/ssl/src/nsCMS.cpp:883
883         NSS_CMSEncoder_Cancel(m_ecx);
(gdb) print m_ecx
$3 = (NSSCMSEncoderContext *) 0x181f1
(gdb) print *m_ecx
$4 = <incomplete type>
(gdb) x/wa *(void**)m_ecx
Cannot access memory at address 0x181f1

Comment 1

[timeless]

Attachment: patch from rginda

Comment 2

[kinmoz]

Comment on attachment 122203 [details] [diff] [review]
patch from rginda

sr=[e-mail]

Comment 3

[Kai Engert (:KaiE:)]

Comment on attachment 122203 [details] [diff] [review]
patch from rginda

r=kaie

Thanks for the fix.

Comment 4

[timeless]

checked in

Comment 5

[John Unruh]

Verified per comments 3 and 4

Comment 6

[Kai Engert (:KaiE:)]

Argh. This bug missed the 1.4 branch! :-(

Comment 7

[Mike Kaply [:mkaply]]

Comment on attachment 122203 [details] [diff] [review]
patch from rginda

a=mkaply for 1.4.1

Comment 8

[Mike Kaply [:mkaply]]

Please add the fixed1.4.1 keyword when this is checked in.