1143130 - nsTextFrame::GetCharacterOffsetAtFrame returns uninitialized nsIFrame::ContentOffsets

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Eric Rahm [:erahm]]

Coverity indicates that |nsTextFrame::GetCharacterOffsetAtFrame| returns an instance of |nsIFrame::ContentOffsets| with unitialized members [1] (offset, secondaryOffset, associate).

This is a non-issue if every usage checks |ContentOffsets::content| prior to using other values. I'm not sure if that's the case.

Flagging as sec as it's not clear to me where/how these uninitialized values are used.

[1] https://hg.mozilla.org/mozilla-central/annotate/11506aaf7064/layout/generic/nsTextFrame.cpp#l6492

Comment 1

[Andrew McCreight [:mccr8]]

Mats, is this something you could look into?  Thanks.

Comment 2

[Mats Palmgren (inactive)]

Attachment: fix

Initialize the members in the default ctor.
Remove the copy ctor and dtor since they are the same as the default.

I checked consumers and they all null-check .content before using
the other fields, or they where invoked on frames guaranteed
not to be text frames so are not affected by the indicated line.
So there's no security issue here afaict.

Comment 3

[Mats Palmgren (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/cbff0d351f74

Comment 4

[Ryan VanderMeulen [:RyanVM][PTO June 24-28]]

https://hg.mozilla.org/mozilla-central/rev/cbff0d351f74