Closed Bug 1429276 Opened 7 years ago Closed 7 years ago

Preferences::Observe can dereference a null pointer

Categories

(Core :: Preferences: Backend, defect)

Product:
Core
Component:
Preferences: Backend
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
firefox59 --- affected

People

(Reporter: emk, Unassigned)

References

Details

Steps to reproduce:
Run the following script from the chrome-privileged context.
  Services.prefs.QueryInterface(Ci.nsIObserver).observe(null, null, null);

Actual result:
bp-44267466-7e41-45da-a16d-b127e1180110
https://hg.mozilla.org/releases/mozilla-release/annotate/afa87f9be3a8/modules/libpref/Preferences.cpp#l852

Expected result:
Should be no-op.

I suspect that other nsIObserver implementations might have similar issues.
emk: are there places where this occurs in practice? It seems like a pathological case and unlikely to happen...
Flags: needinfo?(VYV03354)
It will not happen in practice since legacy add-ons are dead. I considered replacing nsCRT::strcmp with strcmp. The former does null-checks while the latter doesn't.
Flags: needinfo?(VYV03354)
Bug 1413413 removed the offending strcmp.
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.