245516 - SplitPath in nsLocalFileCommon reads off the end of the string

Status: RESOLVED FIXED

(Core :: XPCOM, defect)

Description

[Brodie]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040514
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040514

<http://lxr.mozilla.org/seamonkey/source/xpcom/io/nsLocalFileCommon.cpp#145>

SplitPath has a loop where it splits a path string into an array of path
components. The control statement of the loop checks the current character for
null. Inside the body of the loop however, whenever the current character is
found to be a path sep character, it is nulled out and incremented. If not null,
processing is done. 

Since the for loop will increment the pointer before checking it, this will step
it off the end of the string in the case that it was null.

i.e. if the input string is "c:\" it will step off the end of the string. We
need to break the for loop in this case.

Patch to be attached.


Reproducible: Always
Steps to Reproduce:

Comment 1

[Brodie]

Attachment: patch 1

Where the next character is checked for null, break the loop if it is.

Comment 2

[Brodie]

Comment on attachment 149965 [details] [diff] [review]
patch 1

simple if() statement change.

Comment 3

[timeless]

Comment on attachment 149965 [details] [diff] [review]
patch 1

lose the else

Comment 4

[Brodie]

Attachment: patch 2

Lost the else

Comment 5

[Bernard Alleysson]

confirming because of patch

Comment 6

[Brodie]

patch is written

Comment 7

[Doug Turner (:dougt)]

Checking in nsLocalFileCommon.cpp;
/cvsroot/mozilla/xpcom/io/nsLocalFileCommon.cpp,v  <--  nsLocalFileCommon.cpp
new revision: 1.46; previous revision: 1.45
done


Thank you Brodie.