140484 - tagStr incorrectly freed in nsListCommand::GetCurrentState (lurking crash)

Status: VERIFIED FIXED

(Core :: DOM: Editor, defect, P2)

Description

[Dan McGuirk]

Look at nsListCommand::GetCurrentState(nsIEditor*, const char*,
nsICommandParams*) and GetListState() in
mozilla/editor/composer/src/nsComposerCommands.cpp.  Notice that in the latter
function, _retval is never touched if you're in a mixed state, but in the former
function, tagStr is freed if it is not NULL, and it has never been initialized
to NULL.  In other words, you get a bad free if you're in a mixed state.

The parallel cases in this file seem to be OK, because the called functions set
*_retval = nsnull at the beginning.

Comment 1

[Dan McGuirk]

Attachment: Suggested patch

Suggested patch: Set *_retval to NULL, as is done in the parallel cases, to
avoid the bad free.

Comment 2

[Kathleen :Brade]

probably introduced by mjudge but I'll reassign to jfrancis for review of this patch

Comment 3

[Joe Francis]

Comment on attachment 81249 [details] [diff] [review]
Suggested patch

r = jfrancis

Comment 4

[Joe Francis]

cc'ing kin for sr

Comment 5

[kinmoz]

Comment on attachment 81249 [details] [diff] [review]
Suggested patch

sr=[e-mail]

Comment 6

[Kevin McCluskey (gone)]

nsbeta1+.

Comment 7

[Joe Francis]

fixed on trunk.  Thanks Dan!

Comment 8

[Joe Francis]

vurryphied

Comment 9

[Kevin McCluskey (gone)]

adt1.0.0

Comment 10

[scottputterman]

adding adt1.0.0+.  Please get drivers approval and then check into the 1.0 branch.

Comment 11

[scottputterman]

changing to adt1.0.1+ for checkin to the 1.0 branch for the Mozilla1.0.1
milestone.  Please get drivers approval before checking in.

Comment 12

[Judson Valeski]

please checkin to the 1.0.1 branch. once there, remove the "mozilla1.0.1+"
keyword and add the "fixed1.0.1" keyword.

Comment 13

[Joe Francis]

Branch landing completed.  Now we sit back and watch the money roll in!

Comment 14

[sujay]

marking verified per Joe