283090 - Buffer overrun in content/events/src/nsEventStateManager.cpp

Status: NEW

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[David Gardiner]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

Running PREfast static code analysis gives the following warning:

nseventstatemanager.cpp(3862) : warning 201: Buffer overrun for stack buffer
'notifyContent': index 5 exceeds maximum valid index 4.
problem occurs in function 'nsEventStateManager::SetContentState'

The line in question is:

nsIContent** end  = &(notifyContent[maxNotify]); 

Apologies if this is a false warning.

-dave

Reproducible: Always

Steps to Reproduce:

Comment 1

[Boris Zbarsky [:bzbarsky]]

Yeah, this is sorta a bogus warning... but maybe it would be better written as:

  nsIContent** end  = notifyContent + maxNotify; 

Just to make it clear that this isn't a "real" array dereference?

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee is inactive on Bugzilla, so the assignee is being reset.