1188180 - Possible use of uninitialized |res| in |nsHTMLEditRules::GetNodesForOperation|

Status: RESOLVED FIXED

(Core :: DOM: Editor, enhancement)

Description

[Eric Rahm [:erahm]]

+++ This bug was initially created as a clone of Bug #1149163 +++

Coverity indicates it's possible that |res| [1] is used uninitialized [2]. It would appear this could happen if |rangeCount| is 0 and |aTouchContent == TouchContent::yes|.

[1] https://hg.mozilla.org/mozilla-central/annotate/2ddec2dedced/editor/libeditor/nsHTMLEditRules.cpp#l5765
[2] https://hg.mozilla.org/mozilla-central/annotate/2ddec2dedced/editor/libeditor/nsHTMLEditRules.cpp#l5793

Comment 1

[Aryeh Gregor (:ayg) (no longer with Mozilla)]

Attachment: Patch

Yep, quite correct.  Thanks!  In this case we do need to initialize it.  rangeCount being 0 is not reasonable here, but I don't know if it's impossible.

I don't think this patch needs a try run.

Comment 2

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/352601bcc307

Comment 3

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/352601bcc307