1228077 - third nsZipHandle::Init method doesn't initialize handle->mMap

Status: RESOLVED INVALID

(Core :: Networking: JAR, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

The third nsZipHandle::Init method, introduced in https://hg.mozilla.org/mozilla-central/rev/66d2a14f0fb0 , doesn't initialize handle->mMap, which means that ~nsZipHandle could try to call PR_MemUnmap and PR_CloseFileMap on things that it shouldn't.

I found this by inspection while investigating bug 1194856.

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: Initialize handle->mMap in third nsZipHandle::Init method

Comment 2

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Comment on attachment 8692108 [details] [diff] [review]
Initialize handle->mMap in third nsZipHandle::Init method

Review of attachment 8692108 [details] [diff] [review]:
-----------------------------------------------------------------

mMap is set to nullptr by the constructor; do we support calling Init more than once on the same object?  (Both about this class in particular and as a matter of general style about Init* methods.)

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

(In reply to Jed Davis [:jld] from comment #2)
> mMap is set to nullptr by the constructor

Oops.  I thought I looked and it wasn't.  (I think I thought there wasn't a constructor in the .cpp file.)

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

(The Init method is static and calls the constructor, so it's fine.)