Closed Bug 1276080 Opened 8 years ago Closed 8 years ago

Null deref crash in mozilla::net::nsStreamListenerWrapper::OnStopRequest

Categories

(Core :: Networking, defect)

Product:
Core
Component:
Networking
Platform:
Unspecified
Windows 10
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1274279
Tracking Flags:
Tracking Status
firefox49 --- affected

People

(Reporter: mccr8, Unassigned)

Details

(Keywords: crash)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-5ab07b9c-b51b-4078-8952-b276a2160526.
=============================================================

I see 15 of these crashes in a single Nightly, which is a little odd. But this code looks pretty questionable. If you call OnStopRequest, mListener gets cleared, so if you erroneously call it twice, you get a null deref crash. An addon could easily do this (the crashes are calls from JS). Also, if you somehow call nsStreamListenerWrapper() with null, then you'll have the same problem. So more null checks would be nice. (They are probably also needed in NS_FORWARD_NSISTREAMLISTENER, somehow.)
Patrick, is there somebody who might be able to look at this? If it sounds reasonable.
Flags: needinfo?(mcmanus)
its a dup of 1274279 - I'll ask jason to back his patch out if he can't fix it.
Status: NEW → RESOLVED
Closed: 8 years ago
Flags: needinfo?(mcmanus)
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.