235745 - Possible leak or crash in nsStorageStream

Status: RESOLVED FIXED

(Core :: XPCOM, defect)

Description

[Nick Sayer]

User-Agent:       
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113

It is conceivable that since the return value of nsStorageStream->Init() is not
being checked that an uninitialized nsStorageStream could be returned.

Reproducible: Didn't try
Steps to Reproduce:




See patch

Comment 1

[Nick Sayer]

Attachment: Proposed patch

Comment 2

[Darin Fisher]

Comment on attachment 142358 [details] [diff] [review]
Proposed patch

>Index: io/nsStorageStream.cpp

>     nsStorageStream* storageStream = new nsStorageStream();
>     if (!storageStream) return NS_ERROR_OUT_OF_MEMORY;
>     
>+    nsresult rv = storageStream->Init(segmentSize, maxSize);
>     NS_ADDREF(storageStream);
>+    if (NS_FAILED(rv)) {
>+        NS_RELEASE(storageStream);
>+        return rv;
>+    }
>     *result = storageStream;
>     return NS_OK;
>+}

move the NS_ADDREF above the Init call.  that way, if Init ever changes
such that it needs to call AddRef/Release/QI on |this|, we won't get in
trouble.

r+sr=darin with that.

Comment 3

[timeless]

mozilla/xpcom/io/nsStorageStream.cpp 	1.26