114438 - Ensure nsSharableString doesn't overwrite shared buffers

Status: RESOLVED FIXED

(Core :: XPCOM, defect, P2)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

There are two ways that nsSharableString might overwrite shared buffers:

 1) SetLength() can cause overwriting since it doesn't check the buffer's refcount

 2) using writing iterators can cause ovewriting.  It's not clear how we should
solve this problem in the long term (see bug 114140), but a short-term solution
that works is to override GetWritableFragment.  The long-term solution may
involve changing all the users.

I'll attach the patch that fixes these two issues, which I'd like to get in for
0.9.7.  I previously attached a superset of this patch to bug 112548 (and asked
jag to review the subset that I'm attaching here).

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 61104 [details] [diff] [review]
patch

Transferring r=jag from bug 112548, attachment 61050 [details] [diff] [review]

Comment 3

[Johnny Stenback (:jst)]

Comment on attachment 61104 [details] [diff] [review]
patch

sr=jst

Comment 4

[Cathleen]

dbaron landed the fix on 12/10/2001 19:33