292723 - pReconv->dwSize value is invalid

Status: RESOLVED FIXED

(Core :: Internationalization, defect, P1)

Description

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

in nsWindow.cpp#7060
http://lxr.mozilla.org/seamonkey/source/widget/src/windows/nsWindow.cpp#7060

the dwIndex is set sizeof(RECONVERTSTRING).
But it is invalid. we should set *oResult.

see
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/intl/ime_58tu.asp

"dwSize
    Specifies the size of this structure *and the memory block it heads*."

On Win9x, if we reconvert with ATOK, it is crashed sometimes.
On WinXP, if we using MS-IME 2003, we cannot reconvert.

Comment 1

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

> the dwIndex is set sizeof(RECONVERTSTRING).

Oops. that is dwSize, not dwIndex.

Comment 2

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Patch rv1.0

Comment 3

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 182489 [details] [diff] [review]
Patch rv1.0

>Index: widget/src/windows/nsWindow.cpp
>+    if (pReconv->dwSize < *oResult) {
>+      NS_ASSERTION(pReconv->dwSize >= *oResult, "Reconvert structure size is invalid");
>+      *oResult = 0;
>+      return PR_FALSE;
>+    }

This block makes no sense.  If you mean an NS_ERROR, use an NS_ERROR.  But in
general, is this a fatal condition?  Or one you expect to see sometimes?  In
the former case, just NS_ERROR and don't bother returning.  In the latter case,
you're handling the problem, so no need for NS_ERROR.

Comment 4

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Patch rv1.1

Comment 5

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Comment on attachment 182596 [details] [diff] [review]
Patch rv1.1

This is critical problem on Win9x and major problem with MS-IME2003.
The risk is low.

Comment 6

[Asa Dotzler [:asa]]

Comment on attachment 182596 [details] [diff] [review]
Patch rv1.1

a=asa

Comment 7

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

checked-in.