264825 - "save target as" crashes if host unavailable [@ nsHttpHeaderArray::LookupEntry(nsHttpAtom, nsHttpHeaderArray::nsEntry**)()] [@ nsVoidArray::Count()]

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect, P1)

Description

[Christian :Biesinger (don't email me, ping me on IRC)]

this is because nsHttpChannel::GetContentEncodings unconditionally accesses
mResponseHead, which can be null - for example, if the host does not exist.

try the url field from this bug (this crashes for me; it may need to have a
192.168.1.x network set up. no web server must be running on that server)


Filing this on networking, because VisitResponseHeaders _does_ nullcheck
mResponseHead before dereferencing it, so I suspect this is a bug in
GetContentEncodings. feel free to reassign to file handling if accessing
contentEncodings on a failed channel is not allowed.

in httpchannel, this would probably be as simple as adding an if
(!mResponseHead) return NS_ERROR_NOT_AVAILABLE; to GetContentEncodings.

this was caused by Bug 160454 I'm sure.

Comment 1

[Christian :Biesinger (don't email me, ping me on IRC)]

Attachment: stack

Comment 2

[Boris Zbarsky [:bzbarsky]]

This is a bug in GetContentEncodings, yes.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Patch

Comment 4

[Christian :Biesinger (don't email me, ping me on IRC)]

Comment on attachment 162513 [details] [diff] [review]
Patch

ok; I guess if we have no headers at all, we don't have a content-encoding one
either ;) and so returning null matches the docs.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Yes, that was my reasoning.  ;)

Comment 6

[Boris Zbarsky [:bzbarsky]]

Fixed.

Comment 7

[Martijn Wargers (dead)]

Ok, it doesn't crash anymore with a 2004-10-19 Seamonkey build.
But now a file picker opens up with "U RL.htm" as suggested file name. When
trying to save the file, the download manager tries to download it, and very
misleadingly says after a while it was downloaded, when in fact it wasn't
downloaded.

Comment 8

[Martijn Wargers (dead)]

But maybe that is what bug 174167 is about?

Comment 9

[Boris Zbarsky [:bzbarsky]]

Yes, that's bug 174167