Closed Bug 1234540 Opened 5 years ago Closed 5 years ago

[Static Analysis][Dereference null return value] In function nsCacheEntryHashTable::AddEntry from nsCacheEntry.cpp

Categories

(Core :: Networking: Cache, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla47
Tracking Status
firefox46 --- affected
firefox47 --- fixed

People

(Reporter: andi, Assigned: andi)

References

(Blocks 1 open bug)

Details

(Keywords: coverity, Whiteboard: CID 1324686 [necko-active])

Attachments

(1 file, 1 obsolete file)

The Static Analysis tool Coverity added that pointer hashEntry can be null thus having a null pointer dereference:

>>    hashEntry = table.Add(&(cacheEntry->mKey), fallible);
>>#ifndef DEBUG_dougt
>>    NS_ASSERTION(((nsCacheEntryHashTableEntry *)hashEntry)->cacheEntry == 0,
>>                 "### nsCacheEntryHashTable::AddEntry - entry already used");
>>#endif
>>    ((nsCacheEntryHashTableEntry *)hashEntry)->cacheEntry = cacheEntry;

This can happen if in function table->Add malloc fails because of oom:
>>    MOZ_RELEASE_ASSERT(SizeOfEntryStore(CapacityFromHashShift(), mEntrySize,
>>                                        &nbytes));
>>    mEntryStore.Set((char*)malloc(nbytes));
>>    if (!mEntryStore.Get()) {
>>      return nullptr;
>>    }
Attached patch Bug 1234540.diff (obsolete) — Splinter Review
Attachment #8701042 - Flags: review?(mcmanus)
Attachment #8701042 - Flags: review?(mcmanus) → review?(michal.novotny)
Attached patch Bug 1234540.diffSplinter Review
Attachment #8701042 - Attachment is obsolete: true
Attachment #8701042 - Flags: review?(michal.novotny)
Attachment #8701045 - Flags: review?(michal.novotny)
Attachment #8701045 - Flags: review?(michal.novotny) → review+
please check in the reviewed patch or otherwise resolve this bug. thanks
Flags: needinfo?(bogdan.postelnicu)
Whiteboard: CID 1324686 → CID 1324686 [necko-active]
it's been pushed to inbound.
Flags: needinfo?(bogdan.postelnicu)
https://hg.mozilla.org/mozilla-central/rev/d0459ee243da
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla47
You need to log in before you can comment on or make changes to this bug.