Uninitialised value use in TabParent::AddInitialDnDDataTo

NEW
Unassigned

Status

()

4 years ago
4 years ago

People

(Reporter: jseward, Unassigned)

Tracking

Trunk
Points:
---

Firefox Tracking Flags

(firefox40 affected)

Details

Attachments

(1 attachment)

(Reporter)

Description

4 years ago
For editor/libeditor/tests/test_bug417418.html, Valgrind reports that
item.mType is uninitialised in
TabParent::AddInitialDnDDataTo(DataTransfer* aDataTransfer).

dom/ipc/TabParent.cpp
3207  // Special case kFilePromiseMime so that we get the right
      // nsIFlavorDataProvider for it.
      if (item.mFlavor.EqualsLiteral(kFilePromiseMime)) {
        nsRefPtr<nsISupports> flavorDataProvider =
          new nsContentAreaDragDropDataProvider();
        variant->SetAsISupports(flavorDataProvider);
3213  } else if (item.mType == DataTransferItem::DataType::eString) { <---HERE
        variant->SetAsAString(item.mStringData);
      } else if (item.mType == DataTransferItem::DataType::eBlob) {
        variant->SetAsISupports(item.mBlobData);
      }

From some poking around, I think that |item| was allocated just above
in TabParent::RecvInvokeDragSession, here:

3150  DataTransferItem* localItem = itemArray->AppendElement();

It seems to me that the if-else if that immediately follows, can fail
to write any value to localItem->mType.  And mType is just an enum so
there is no automatic initialisation of it via a constructor, inside
AppendElement.  So if neither the if .. nor the else if .. are taken,
then localItem->mType is uninitialised.
(Reporter)

Comment 1

4 years ago
Created attachment 8595814 [details]
Valgrind complainage
(Reporter)

Comment 2

4 years ago
Possibly related to bug 936092.
You need to log in before you can comment on or make changes to this bug.