|TabChild::RecvRealMouseButtonEvent| passes uninitialized value |unused| to |InputAPZContext|

RESOLVED WONTFIX

Status

()

Core
DOM: Content Processes
RESOLVED WONTFIX
2 years ago
2 years ago

People

(Reporter: erahm, Unassigned)

Tracking

({coverity})

Trunk
coverity
Points:
---

Firefox Tracking Flags

(firefox44 affected)

Details

(Whiteboard: [CID 1325956])

Coverity indicates |TabChild::RecvRealMouseButtonEvent| passes uninitialized value |unused| [1] to |InputAPZContext| which then stores it in a member and static variable [2]. 

It's possible this is harmless but it looks like the simplest solution would be to initialize the value to |nsEventStatus_eIgnore|.

Flagging as sec as I haven't determined whether this can lead to undefined behavior or not.

[1] https://dxr.mozilla.org/mozilla-central/rev/f7b746b4e91307448cb0746a41f677bfc23908b0/dom/ipc/TabChild.cpp#1930
[2] https://dxr.mozilla.org/mozilla-central/rev/f7b746b4e91307448cb0746a41f677bfc23908b0/gfx/layers/apz/util/InputAPZContext.cpp#45,50
Group: core-security → dom-core-security
This should be harmless. It was in fact done intentionally - see https://bugzilla.mozilla.org/show_bug.cgi?id=1199885#c101. Is there a way to make Coverity ignore it unless the garbage starts getting used?
FWIW I'm not opposed to initializing it to something if that's the pragmatic thing to do.
Group: dom-core-security
Status: NEW → RESOLVED
Last Resolved: 2 years ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.