333691 - [@ nsSSLThread::requestPoll - nsSSLIOLayerPoll]

Status: RESOLVED FIXED

(Core Graveyard :: Security: UI, defect)

Description

[timeless]

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/manager/ssl/src/nsSSLThread.cpp&rev=1.2&mark=220#215

if out_flags can really be null then this code path crashes in nsSSLThread::rquestPoll.

Comment 1

[Kai Engert [:KaiE:]]

Thanks for catching this.
According to http://www.mozilla.org/projects/nspr/tech-notes/poll-method.html
I believe it does not make any sense to call the poll method with a null out_flags, but I agree we should make the code failsafe.

Patch coming up

Comment 2

[Kai Engert [:KaiE:]]

Attachment: Patch v1

Comment 3

[Robert Relyea]

Comment on attachment 218155 [details] [diff] [review]
Patch v1

r+
patch fixes the problem described in the bug.

Comment 4

[Kai Engert [:KaiE:]]

checked in

Comment 5

[Henrik Skupin [:whimboo][⌚️UTC+1]]

I got such a crash today with Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.16) Gecko/20080707 Thunderbird/2.0.0.16 ID:2008070710

Is it related in some way or should I file a new bug?

Process:         thunderbird-bin [257]
Path:            /Applications/Thunderbird.app/Contents/MacOS/thunderbird-bin
Identifier:      org.mozilla.thunderbird
Version:         2.0.0.16 (2.0.0.16)
Code Type:       X86 (Native)
Parent Process:  launchd [1]

Date/Time:       2008-08-03 10:52:12.969 +0200
OS Version:      Mac OS X 10.5.4 (9E17)
Report Version:  6

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x00000000697075bf
Crashed Thread:  1

Thread 1 Crashed:
0   org.mozilla.thunderbird       	0x00454d02 nsSSLThread::requestPoll(nsNSSSocketInfo*, short, short*) + 344
1   org.mozilla.thunderbird       	0x004567c6 nsSSLIOLayerHelpers::Cleanup() + 374
2   libnspr4.dylib                	0x00ef6ce1 PR_Poll + 939
3   org.mozilla.thunderbird       	0x00441c7f nsSocketTransportService::Poll(unsigned int*) + 99
4   org.mozilla.thunderbird       	0x0044225d nsSocketTransportService::ServiceEventQ() + 623
5   libxpcom_core.dylib           	0x00e4dfe3 nsThread::Main(void*) + 41
6   libnspr4.dylib                	0x00ef7ffd PR_Select + 813
7   libSystem.B.dylib             	0x919df6f5 _pthread_start + 321
8   libSystem.B.dylib             	0x919df5b2 thread_start + 34