Closed Bug 1216810 Opened 4 years ago Closed 4 years ago

|TabChild::RecvRealMouseButtonEvent| passes uninitialized value |unused| to |InputAPZContext|

Categories

(Core :: DOM: Content Processes, defect)

defect
Not set

Tracking

()

RESOLVED WONTFIX
Tracking Status
firefox44 --- affected

People

(Reporter: erahm, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: coverity, Whiteboard: [CID 1325956])

Coverity indicates |TabChild::RecvRealMouseButtonEvent| passes uninitialized value |unused| [1] to |InputAPZContext| which then stores it in a member and static variable [2]. 

It's possible this is harmless but it looks like the simplest solution would be to initialize the value to |nsEventStatus_eIgnore|.

Flagging as sec as I haven't determined whether this can lead to undefined behavior or not.

[1] https://dxr.mozilla.org/mozilla-central/rev/f7b746b4e91307448cb0746a41f677bfc23908b0/dom/ipc/TabChild.cpp#1930
[2] https://dxr.mozilla.org/mozilla-central/rev/f7b746b4e91307448cb0746a41f677bfc23908b0/gfx/layers/apz/util/InputAPZContext.cpp#45,50
Group: core-security → dom-core-security
This should be harmless. It was in fact done intentionally - see https://bugzilla.mozilla.org/show_bug.cgi?id=1199885#c101. Is there a way to make Coverity ignore it unless the garbage starts getting used?
FWIW I'm not opposed to initializing it to something if that's the pragmatic thing to do.
Group: dom-core-security
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.