134119 - memory corruption in mdn code

Status: VERIFIED FIXED

(MailNews Core :: Backend, defect)

Description

[David :Bienvenu]

nsParseMailMessageState::GetAllHeaders(char ** pHeaders, PRInt32 *pHeadersSize)
is used like this:
            rv = m_msgParser->GetAllHeaders(getter_Copies(headers),

but it's not allocating a copy of the headers, so memory gets corrupted. Fix
upcoming.

Comment 1

[David :Bienvenu]

Attachment: proposed fix

GetAllHeaders doesn't dup the headers, so can't use nsXPIDLCString or
getter_Copies

Comment 2

[David :Bienvenu]

this was found with purify. I'm not sure why we're getting into this code - I'll
look into that as well.

Comment 3

[Jeff Tsai]

Looks like m_headers is a nsByteArray and GetAllHeaders() simply returns pointer 
to the buffer without allocating new buffer that's why we got memory 
corruptions. The patch looks good to me. r=jefft

Comment 4

[Jeff Tsai]

Comment on attachment 76697 [details] [diff] [review]
proposed fix

r=jefft

Comment 5

[(not reading, please use [e-mail] instead)]

Comment on attachment 76697 [details] [diff] [review]
proposed fix

sr=sspitzer

Comment 6

[David :Bienvenu]

adding keywords.

Comment 7

[(not reading, please use [e-mail] instead)]

fix checked in for bienvenu, granrose approved it.

I'll send mail to antitux, so that we can get this in the next respin this morning.

Comment 8

[grylchan]

silly question: how do I confirm this?

What happened before it was fixed (i see keyword
crash).

thnx

Comment 9

[[e-mail] (gone - use [e-mail] instead)]

David, I should be able to help Gary out with the verification of this.

Was this a UMR, FMM, or a straight leak?  Thanks!

Comment 10

[David :Bienvenu]

this was a Freed memory read, write (FMR, FMW?)

Comment 11

[[e-mail] (gone - use [e-mail] instead)]

I don't see anything in Purify other than the usual leaks and UMRs...

I ran with the pref enabled and sent a message that requires an MDN, and read 
that same message and sent acknowledgement.

Verified FIXED with a current opt trunk build.