SplitPath in nsLocalFileCommon reads off the end of the string

RESOLVED FIXED

Status

()

RESOLVED FIXED
15 years ago
15 years ago

People

(Reporter: bmo, Assigned: bmo)

Tracking

Trunk
x86
Windows XP
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(URL)

Attachments

(1 attachment, 1 obsolete attachment)

1.09 KB, patch
timeless
: review+
Details | Diff | Splinter Review
(Assignee)

Description

15 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040514
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040514

<http://lxr.mozilla.org/seamonkey/source/xpcom/io/nsLocalFileCommon.cpp#145>

SplitPath has a loop where it splits a path string into an array of path
components. The control statement of the loop checks the current character for
null. Inside the body of the loop however, whenever the current character is
found to be a path sep character, it is nulled out and incremented. If not null,
processing is done. 

Since the for loop will increment the pointer before checking it, this will step
it off the end of the string in the case that it was null.

i.e. if the input string is "c:\" it will step off the end of the string. We
need to break the for loop in this case.

Patch to be attached.


Reproducible: Always
Steps to Reproduce:
(Assignee)

Comment 1

15 years ago
Created attachment 149965 [details] [diff] [review]
patch 1

Where the next character is checked for null, break the loop if it is.
(Assignee)

Comment 2

15 years ago
Comment on attachment 149965 [details] [diff] [review]
patch 1

simple if() statement change.
Attachment #149965 - Flags: superreview?(dougt)
Attachment #149965 - Flags: review?(darin)

Comment 3

15 years ago
Comment on attachment 149965 [details] [diff] [review]
patch 1

lose the else
(Assignee)

Comment 4

15 years ago
Created attachment 149967 [details] [diff] [review]
patch 2

Lost the else
Attachment #149965 - Attachment is obsolete: true
(Assignee)

Updated

15 years ago
Attachment #149965 - Flags: superreview?(dougt)
Attachment #149965 - Flags: review?(darin)
(Assignee)

Updated

15 years ago
Attachment #149967 - Flags: review?(timeless)

Comment 5

15 years ago
confirming because of patch
Status: UNCONFIRMED → NEW
Ever confirmed: true
(Assignee)

Comment 6

15 years ago
patch is written
Assignee: dougt → brofield
(Assignee)

Updated

15 years ago
Attachment #149967 - Flags: superreview?(dougt)

Updated

15 years ago
Attachment #149967 - Flags: review?(timeless) → review+

Updated

15 years ago
Attachment #149967 - Flags: superreview?(dougt) → superreview+

Comment 7

15 years ago
Checking in nsLocalFileCommon.cpp;
/cvsroot/mozilla/xpcom/io/nsLocalFileCommon.cpp,v  <--  nsLocalFileCommon.cpp
new revision: 1.46; previous revision: 1.45
done


Thank you Brodie.
Status: NEW → RESOLVED
Last Resolved: 15 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.