1212223 - nsMultiMixedConv might call |SendData| with incorrect buffer length

Status: RESOLVED FIXED

(Core :: Networking, defect)

Description

[Henry Chang [:hchang]]

When we hit [1] (the multipart content has preamble and the first token is probed), we only update the cursor to the first token without updating |bufLen|, which will be incorrectly used to compute the data length of |SendData| in [2] if the first chunk from network doesn't contain the entire subresource. (if the first chunk contains all of the first subresource it would be fine since the callback length is not derived from bufLen.) 

[1] http://hg.mozilla.org/mozilla-central/file/727d765a5ed8/netwerk/streamconv/converters/nsMultiMixedConv.cpp#l666
[2] http://hg.mozilla.org/mozilla-central/file/727d765a5ed8/netwerk/streamconv/converters/nsMultiMixedConv.cpp#l825

Comment 1

[Henry Chang [:hchang]]

Attachment: Bug1212223.patch

Comment 2

[Henry Chang [:hchang]]

Comment on attachment 8670635 [details] [diff] [review]
Bug1212223.patch

Hi Valentin,

Could you please have a review of this patch? To prevent from any potential edge case, I add a couple of different chunks in the test case. Thanks!

Comment 3

[Henry Chang [:hchang]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=ace93165cd9a

Comment 4

[Valentin Gosu [:valentin] (he/him)]

Comment on attachment 8670635 [details] [diff] [review]
Bug1212223.patch

Review of attachment 8670635 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good. Nice catch.

Comment 5

[Henry Chang [:hchang]]

Attachment: Bug1212223.patch (r+'d, add reviewer)

Comment 6

[Henry Chang [:hchang]]

Thank you Valentin :)

Comment 7

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/fe4a2767f51f

Comment 8

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/fe4a2767f51f