338179 - Ineffective NULL checks in nsSocket::Send, nsSocket::Recv (xpinstall/wizard/libxpnet/src/nsSocket.cpp)

Status: RESOLVED FIXED

(SeaMonkey :: Installer, defect)

Description

[Kenneth Herron]

This is coverity CIDs 237 and 238. Please refer to the sample URL.

|nsSocket::Send| (line 291) and nsSocket::Recv| (line 358) both check their arguments and return E_PARAM on an error. But the checks ignore null |aBufSize|. Both functions unconditionally dereference |aBufSize| later.

Comment 1

[Duncan Mak]

Attachment: Patch to add checks for aBufSize

Is this it? It's a 2 line patch to add checks for aBufSize.

Comment 2

[Andrew Schultz]

Comment on attachment 224809 [details] [diff] [review]
Patch to add checks for aBufSize

>+    if (!aBuf || !aBufSize || (aBufSize && (*aBufSize <= 0)) || mFd < 0)

If the !aBufSize test fails, you don't need to check aBufSize again
!aBufSize || (*aBufSize <= 0)

Comment 3

[(no longer active)]

Attachment: Patch to add checks for aBufSize (revised)

Doing the obvious...  :-)

Comment 4

[Andrew Schultz]

Comment on attachment 235874 [details] [diff] [review]
Patch to add checks for aBufSize (revised)

I'm not an SR, but this patch is sufficiently trivial.

Comment 5

[Andrew Schultz]

landed on trunk.
thanks, Ehsan