Variable "(cache)->sharedCache" tracked as NULL was passed to a function that dereferences it. [@ CloseCache - InitCache]

RESOLVED FIXED in 3.11.3

Status

NSS
Libraries
P2
critical
RESOLVED FIXED
12 years ago
7 years ago

People

(Reporter: timeless, Assigned: Alexei Volkov)

Tracking

({coverity, crash})

3.11
3.11.3
All
Linux
coverity, crash

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [CID 203], crash signature, URL)

Attachments

(1 attachment)

fix
1.94 KB, patch
Nelson Bolyard (seldom reads bugmail)
: review+
Details | Diff | Splinter Review
(Reporter)

Description

12 years ago
found by coverity
Target Milestone: --- → 3.11.1
Priority: -- → P2
Hardware: PC → All
(Assignee)

Comment 1

12 years ago
Does not look like a bug to me. 

sharedCache and cacheMem both get assigned to NULL/0 in the beginning of InitCache function. 
939     cache->shared = shared;
940     cache->cacheMem    = cacheMem    = NULL;
941     cache->cacheMemMap = cacheMemMap = NULL;
942     cache->sharedCache = (cacheDesc *)0;

Later in the same function, both variable get set to cacheMem, but only after cacheMem allocation is successful.

1071     cache->cacheMem    = cacheMem;
1072     cache->sharedCache = (cacheDesc *)cacheMem;

Therefore it is sufficient to verify that cacheMem is not NULL to proceed with 
dereferencing of sharedCache in function CloseCash. 
(Assignee)

Updated

12 years ago
Status: NEW → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → INVALID
In this function, there are some lines of code that look like this:
     cfn = PR_smprintf( ...

PR_smprintf allocates the memory it returns. 
If it fails to allocate that memory (out of memory), 
then the code below it goes to loser 
with (cache)->sharedCache still NULL.
Status: RESOLVED → REOPENED
Resolution: INVALID → ---
Assignee: nobody → alexei.volkov.bugs
Status: REOPENED → NEW
Target Milestone: 3.11.1 → 3.11.2
(Assignee)

Comment 3

12 years ago
Coverity CID 203
Whiteboard: [CID 203]

Comment 4

12 years ago
Retargetting all P2s to 3.11.3 .
Target Milestone: 3.11.2 → 3.11.3
(Assignee)

Comment 5

12 years ago
Created attachment 226831 [details] [diff] [review]
fix
Attachment #226831 - Flags: review?(nelson)
Comment on attachment 226831 [details] [diff] [review]
fix

r=nelson
Attachment #226831 - Flags: review?(nelson) → review+
(Assignee)

Comment 7

12 years ago
tip:
new revision: 1.38; previous revision: 1.37

3.11 branch:
new revision: 1.36.2.2; previous revision: 1.36.2.1
Assignee: alexei.volkov.bugs → nobody
(Assignee)

Comment 8

12 years ago
tip:
new revision: 1.38; previous revision: 1.37

3.11 branch:
new revision: 1.36.2.2; previous revision: 1.36.2.1
Assignee: nobody → alexei.volkov.bugs
(Assignee)

Updated

12 years ago
Status: NEW → RESOLVED
Last Resolved: 12 years ago12 years ago
Resolution: --- → FIXED
Crash Signature: [@ CloseCache - InitCache]
You need to log in before you can comment on or make changes to this bug.