296892 - OOM crash [@ nsSocketTransport::Init]

Status: RESOLVED FIXED

(Core :: Networking, defect)

Description

[timeless]

this is an audit, the Init methods need to complain if !mLock, and you can't 
assume strdup will succeed (strcmp will crash when you're wrong).

Comment 1

[Darin Fisher]

Any crashes show up in talkback?  Patches welcome.

Comment 2

[timeless]

Attachment: handle failures...

Comment 3

[timeless]

Attachment: -w for review

Comment 4

[Darin Fisher]

Comment on attachment 185536 [details] [diff] [review]
-w for review

Hmm.. have you tested this with a HTTP proxy configured?  hint: there should be
no registered socket provider for a socket type of "http", which is why we only
enter the loop to process typeCount socket types.

Comment 5

[Darin Fisher]

Comment on attachment 185536 [details] [diff] [review]
-w for review

OK, my previous comment can be ignored.  I forgot that we
treat proxy types of "http" and "direct" as NULL before
entering this block of code that you are changing.


>Index: mozilla/netwerk/base/src/nsSocketTransport2.cpp

>+        if (!mTypes[i]) {
>+            mTypeCount = i - 1;
>+            return NS_ERROR_OUT_OF_MEMORY;
>+        }

What if |i == 0| when we hit this condition?

Comment 6

[Darin Fisher]

Comment on attachment 185536 [details] [diff] [review]
-w for review

I recall that timeless proposed a reasonable fix for this problem over IRC. 
Marking review- to get attention.

Comment 7

[timeless]

Attachment: -w for review. special case i = 0

Comment 8

[Darin Fisher]

Comment on attachment 186466 [details] [diff] [review]
-w for review. special case i = 0

>Index: mozilla/netwerk/base/src/nsSocketTransport2.cpp

>+        if (!mTypes[i]) {
>+            mTypeCount = i ? i - 1 : 0;
>+            return NS_ERROR_OUT_OF_MEMORY;

Actually, shouldn't this be:  "mTypeCount = i;"

Afterall, if the element at index i is null, then it means that we have
i valid elements.  "The length of a string indexes the null terminator."

Comment 9

[timeless]

Attachment: -w for review. no special casing!

oops, indeed you're right, thanks :)

Comment 10

[timeless]

Comment on attachment 186539 [details] [diff] [review]
-w for review. no special casing!

mozilla/netwerk/base/src/nsSocketTransport2.cpp 	1.34