[Static Analysis][Dereference null return value] In function nsCacheEntryHashTable::AddEntry from nsCacheEntry.cpp

RESOLVED FIXED in Firefox 47

Status

()

defect
RESOLVED FIXED
4 years ago
3 years ago

People

(Reporter: andi, Assigned: andi)

Tracking

(Blocks 1 bug, {coverity})

Trunk
mozilla47
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox46 affected, firefox47 fixed)

Details

(Whiteboard: CID 1324686 [necko-active])

Attachments

(1 attachment, 1 obsolete attachment)

The Static Analysis tool Coverity added that pointer hashEntry can be null thus having a null pointer dereference:

>>    hashEntry = table.Add(&(cacheEntry->mKey), fallible);
>>#ifndef DEBUG_dougt
>>    NS_ASSERTION(((nsCacheEntryHashTableEntry *)hashEntry)->cacheEntry == 0,
>>                 "### nsCacheEntryHashTable::AddEntry - entry already used");
>>#endif
>>    ((nsCacheEntryHashTableEntry *)hashEntry)->cacheEntry = cacheEntry;

This can happen if in function table->Add malloc fails because of oom:
>>    MOZ_RELEASE_ASSERT(SizeOfEntryStore(CapacityFromHashShift(), mEntrySize,
>>                                        &nbytes));
>>    mEntryStore.Set((char*)malloc(nbytes));
>>    if (!mEntryStore.Get()) {
>>      return nullptr;
>>    }
Posted patch Bug 1234540.diff (obsolete) — Splinter Review
Attachment #8701042 - Flags: review?(mcmanus)
Attachment #8701042 - Flags: review?(mcmanus) → review?(michal.novotny)
Attachment #8701042 - Attachment is obsolete: true
Attachment #8701042 - Flags: review?(michal.novotny)
Attachment #8701045 - Flags: review?(michal.novotny)
Attachment #8701045 - Flags: review?(michal.novotny) → review+
please check in the reviewed patch or otherwise resolve this bug. thanks
Flags: needinfo?(bogdan.postelnicu)
Whiteboard: CID 1324686 → CID 1324686 [necko-active]
it's been pushed to inbound.
Flags: needinfo?(bogdan.postelnicu)
https://hg.mozilla.org/mozilla-central/rev/d0459ee243da
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla47
You need to log in before you can comment on or make changes to this bug.