243939 - [W] UMR: Uninitialized memory read in CopyNormalizeNewlines<NormalizeNewlinesCharTraits<WORD *>>::write(WORD const*,UINT) {78 occurrences}

Status: NEW

(Core :: DOM: Core & HTML, defect, P5)

Description

[timeless]

[W] UMR: Uninitialized memory read in 
CopyNormalizeNewlines<NormalizeNewlinesCharTraits<WORD *>>::write(WORD 
const*,UINT) {78 occurrences}
        Reading 1 byte from 0x10a6fbe9 (1 byte at 0x10a6fbe9 uninitialized)
        Address 0x10a6fbe9 is 9 bytes into a 14 byte block at 0x10a6fbe0
        Address 0x10a6fbe9 points to a HeapAlloc'd block in heap 0x00d80000
        Thread ID: 0xa08
        Error location
            CopyNormalizeNewlines<NormalizeNewlinesCharTraits<WORD *>>::write
(WORD const*,UINT)+0x8c [r:\mozilla\content\base\src\nscontentutils.cpp:296 
ip=0x043bd198]
                      const typename OutputIterator::value_type* done_writing = 
aSource + aSourceLength;
                
                      // If the last source buffer ended with a CR...
                      if (mLastCharCR) {
                        // ..and if the next one is a LF, then skip it since
                        // we've already written out a newline
                        if (aSourceLength && (*aSource == value_type('\n'))) {
                          ++aSource;
                        }
                        mLastCharCR = PR_FALSE;
                      }
                
                      PRUint32 num_written = 0;
                      while ( aSource < done_writing ) {
             =>         if (*aSource == value_type('\r')) {
                          mDestination->writechar('\n');
                          ++aSource;
                          // If we've reached the end of the buffer, record
                          // that we wrote out a CR
                          if (aSource == done_writing) {
                            mLastCharCR = PR_TRUE;
                          }
                          // If the next character is a LF, skip it
                          else if (*aSource == value_type('\n')) {
                            ++aSource;
                          }
                        }
                        else {
                          mDestination->writechar(*aSource++);
            copy_string(nsReadingIterator<WORD>&,nsReadingIterator<WORD> 
const&,CopyNormalizeNewlines<NormalizeNewlinesCharTraits<WORD *>>&)+0x54 
[r:\mozilla\pure-i586-pc-msvc\dist\include\string\nsalgorithm.h:95 
ip=0x043c2691]
                        ++result;
                    return result;
                  }
                
                template <class InputIterator, class OutputIterator>
                inline
                OutputIterator&
                copy_string( InputIterator& first, const InputIterator& last, 
OutputIterator& result )
                  {
                    typedef nsCharSourceTraits<InputIterator> source_traits;
                    typedef nsCharSinkTraits<OutputIterator>  sink_traits;
                
                    while ( first != last )
                      {
             =>         PRInt32 count_copied = PRInt32(sink_traits::write
(result, source_traits::read(first), source_traits::readable_distance(first, 
last)));
                        NS_ASSERTION(count_copied > 0, "|copy_string| will 
never terminate");
                        source_traits::advance(first, count_copied);
                      }
                
                    return result;
                  }
                
                template <class InputIterator, class OutputIterator>
                OutputIterator&
                copy_string_backward( const InputIterator& first, 
InputIterator& last, OutputIterator& result )
                  {
                    while ( first != last )
                      {
                        last.normalize_backward();
            nsContentUtils::CopyNewlineNormalizedUnicodeTo(nsAString 
const&,UINT,WORD *,UINT,int&)+0x144 
[r:\mozilla\content\base\src\nscontentutils.cpp:340 ip=0x043c2d69]
                PRUint32
                nsContentUtils::CopyNewlineNormalizedUnicodeTo(const nsAString& 
aSource,
                                                               PRUint32 
aSrcOffset,
                                                               PRUnichar* aDest,
                                                               PRUint32 aLength,
                                                               PRBool& 
aLastCharCR)
                {
                  typedef NormalizeNewlinesCharTraits<PRUnichar*> sink_traits;
                
                  sink_traits dest_traits(aDest);
                  CopyNormalizeNewlines<sink_traits> normalizer
(&dest_traits,aLastCharCR);
                  nsReadingIterator<PRUnichar> fromBegin, fromEnd;
                  copy_string(aSource.BeginReading(fromBegin).advance( PRInt32
(aSrcOffset) ),
                              aSource.BeginReading(fromEnd).advance( PRInt32
(aSrcOffset+aLength) ),
             =>               normalizer);
                  aLastCharCR = normalizer.IsLastCharCR();
                  return normalizer.GetCharsWritten();
                }
                
                // static
                PRUint32
                nsContentUtils::CopyNewlineNormalizedUnicodeTo
(nsReadingIterator<PRUnichar>& aSrcStart, const nsReadingIterator<PRUnichar>& 
aSrcEnd, nsAString& aDest)
                {
                  typedef nsWritingIterator<PRUnichar> WritingIterator;
                  typedef NormalizeNewlinesCharTraits<WritingIterator> 
sink_traits;
                
                  WritingIterator iter;
                  aDest.BeginWriting(iter);
                  sink_traits dest_traits(iter);
            SinkContext::AddText(nsAString const&)+0x1a1 
[r:\mozilla\content\html\document\src\nshtmlcontentsink.cpp:1778 ip=0x0447cb37]
                      amount = addLen;
                    }
                
                    if (amount == 0) {
                      // Don't release last text node so we can add to it again
                      nsresult rv = FlushText();
                      if (NS_FAILED(rv)) {
                        return rv;
                      }
                    }
                
                    mTextLength +=
                      nsContentUtils::CopyNewlineNormalizedUnicodeTo(aText, 
offset,
                                                                     &mText
[mTextLength],
             =>                                                      amount, 
isLastCharCR);
                    offset += amount;
                    addLen -= amount;
                  }
                
                  return NS_OK;
                }
                
                /**
                 * Flush all elements that have been seen so far such that
                 * they are visible in the tree. Specifically, make sure
                 * that they are all added to their respective parents.
                 * Also, do notification at the top for all content that
                 * has been newly added so that the frame tree is complete.
                 */
            SinkContext::AddLeaf(nsIParserNode const&)+0xcd 
[r:\mozilla\content\html\document\src\nshtmlcontentsink.cpp:1578 ip=0x0447f53c]
        Allocation location
            HeapAlloc+0xc        [C:\WINDOWS\System32\KERNEL32.dll 
ip=0x67e633c8]
            heap_alloc+0x4a      [f:\vs70builds\9466
\vc\crtbld\crt\src\malloc.c:211 ip=0x7c0010d3]
            nh_malloc+0x10       [C:\WINDOWS\System32\MSVCR70.dll:106 
ip=0x7c00107b]
            nsStringHeader::Alloc(UINT)+0x27 
[r:\mozilla\xpcom\string\src\nssubstring.cpp:145 ip=0x0179330a]
            nsSubstring::MutatePrep(UINT,WORD * *,UINT *)+0x1d9 
[r:\mozilla\xpcom\string\src\nstsubstring.cpp:136 ip=0x017943e9]
            nsSubstring::SetCapacity(UINT)+0x120 
[r:\mozilla\xpcom\string\src\nstsubstring.cpp:452 ip=0x01794866]
            nsSubstring::SetLength(UINT)+0x2c 
[r:\mozilla\xpcom\string\src\nstsubstring.cpp:480 ip=0x017949c1]
            nsScannerSubstring::AsString(void)const+0x2e 
[r:\mozilla\parser\htmlparser\src\nsscannerstring.cpp:246 ip=0x05191b1d]
            SinkContext::AddLeaf(nsIParserNode const&)+0xa0 
[r:\mozilla\content\html\document\src\nshtmlcontentsink.cpp:1578 ip=0x0447f50f]