112341 - MLK: Memory leak of 144 bytes from 1 block allocated in PL_strdup

Status: NEW

(MailNews Core :: MIME, defect)

Description

[Navin Gupta]

Again fwding as inline....

        Distribution of leaked blocks
        Allocation location
        malloc         [dbgheap.c:129]
        PL_strdup      [strdup.c:46]
        nsCRT::strdup(char const*) [nsCRT.h:182]
        mime_bridge_create_draft_stream [mimedrft.cpp:2016]
            PR_FREEIF(mdd);
            return nsnull;
          }
     => 
          mdd->options->url = nsCRT::strdup(mdd->url_name);
          mdd->options->format_out = format_out;     // output format
          mdd->options->decompose_file_p = PR_TRUE; /* new field in 
MimeDisplayOptions */
        bridge_create_stream [nsStreamConverter.cpp:101]
        {
          if  ( (format_out == nsMimeOutput::nsMimeMessageDraftOrTemplate) ||
                (format_out == nsMimeOutput::nsMimeMessageEditorTemplate) )
     =>     return mime_bridge_create_draft_stream(newEmitter, newPluginObj2, 
uri, format_out);
          else
            return mime_bridge_create_display_stream(newEmitter, newPluginObj2, 
uri, format_out, whattodo,
                                                     aChannel);
        nsStreamConverter::Init(nsIURI *,nsIStreamListener *,nsIChannel *) 
[nsStreamConverter.cpp:740]
            return NS_OK;
          else
          {
     =>     mBridgeStream = bridge_create_stream(mEmitter, this, aURI, newType, 
whattodo, aChannel);
                        if (!mBridgeStream)
                          return NS_ERROR_OUT_OF_MEMORY;
                        else
                nsStreamConverter::AsyncConvertData(WORD const*,WORD 
const*,nsIStreamListener *,nsISupports *) [nsStreamConverter.cpp:1117]
                    
                        nsCOMPtr<nsIURI> aUri;
                        aChannel->GetURI(getter_AddRefs(aUri));
                 =>     return Init(aUri, aListener, aChannel);
                    }
                    
                    NS_IMETHODIMP nsStreamConverter::FirePendingStartRequest()
                nsMsgDraft::ProcessDraftOrTemplateOperation(char 
const*,int,nsIMsgIdentity *,nsIMsgDBHdr * *,nsIMsgWindow *) 
[nsMsgCreate.cpp:178]
                    
                      nsCOMPtr<nsIChannel> dummyChannel;
                      rv = 
NS_NewInputStreamChannel(getter_AddRefs(dummyChannel), aURL, nsnull, nsnull, 
-1);
                 =>   if (NS_FAILED(mimeParser->AsyncConvertData(nsnull, nsnull, 
nsnull, dummyChannel)))
                      {
                        Release();
                        mMessageService = nsnull;
                nsMsgDraft::OpenDraftMsg(char const*,nsIMsgDBHdr * 
*,nsIMsgIdentity *,int,nsIMsgWindow *) [nsMsgCreate.cpp:216]
                    
                      mAddInlineHeaders = addInlineHeaders;
                      return ProcessDraftOrTemplateOperation(msgURI, 
nsMimeOutput::nsMimeMessageDraftOrTemplate,
                 =>                                          identity, 
aMsgToReplace, aMsgWindow);
                    }
                    
                    nsresult
                nsMsgComposeService::OpenComposeWindow(char const*,char 
const*,int,int,nsIMsgIdentity *,nsIMsgWindow *) [nsMsgComposeService.cpp:276]
                          switch(type)
                          {
                            case nsIMsgCompType::ForwardInline:
                 =>             rv = pMsgDraft->OpenDraftMsg(uriToOpen.get(), 
nsnull, identity, PR_TRUE, aMsgWindow);
                              break;
                            case nsIMsgCompType::Draft:
                                rv = pMsgDraft->OpenDraftMsg(uriToOpen.get(), 
nsnull, identity, PR_FALSE, aMsgWindow);

Comment 1

[Navin Gupta]

reassigning and cc'ing for reviews for upcoming patch

Comment 2

[Navin Gupta]

Attachment: proposed fix

options->url is const char* and never owns the buffer, it seems to always point

to mdd->url_name and I have tested it works.

Comment 3

[Navin Gupta]

for example from mimemoz2.cpp:1497 

>  msd->options->url = msd->url_name;

Comment 4

[David :Bienvenu]

you should run under purify. The owner of the string could free it out from
under you.

Comment 5

[Jean-Francois Ducarroz]

Comment on attachment 59490 [details] [diff] [review]
proposed fix

You cannot do that, unless you find a new fix for bug 31207. I know that sound
uggly.

Comment 6

[(not reading, please use [e-mail] instead)]

mass re-assign.

Comment 7

[(not reading, please use [e-mail] instead)]

sorry for the spam.  making bugzilla reflect reality as I'm not working on these bugs.  filter on FOOBARCHEESE to remove these in bulk.

Comment 8

[Serge Gautherie (:sgautherie)]

Filter on "Nobody_NScomTLD_20080620"