317959 - nsTArray crashes when dealing with 0-sized arrays

Status: RESOLVED FIXED

(Core :: XPCOM, defect)

Description

[Brian Ryner (not reading)]

nsTArray's Replace/InsertElementsAt and AppendElements unconditionally dereference [0] on the array that's passed to the method.  This isn't safe if the other array has 0 elements.  Patch coming up.

Comment 1

[Brian Ryner (not reading)]

Attachment: patch

Comment 2

[Darin Fisher]

Comment on attachment 204317 [details] [diff] [review]
patch

>Index: nsTArray.h

>     PRBool ReplaceElementsAt(index_type start, size_type count,
>                              const self_type& a) {
>-      return ReplaceElementsAt(start, count, &a[0], a.Length());
>+      PRUint32 length = a.Length();
>+      return (length == 0) ? PR_TRUE
>+        : ReplaceElementsAt(start, count, &a[0], length);
>     }

If |a| is empty (see .IsEmpty() method), then that doesn't make
ReplaceElementsAt a no-op.  Instead, it means that we need to 
remove |count| elements from the offset |start|.

It'd be nice if there was a way to avoid the branches checking
for an empty string.  Perhaps the solution is to use |a.Elements()|
instead of "&a[0]".

Comment 3

[Darin Fisher]

Attachment: v1 patch

Comment 4

[Brian Ryner (not reading)]

checked in