347660 - nsBufferedOutputStream::WriteSegments doesn't handle the reader returning zero

Status: NEW

(Core :: Networking, defect, P5)

Description

[Christian :Biesinger (don't email me, ping me on IRC)]

Per http://lxr.mozilla.org/seamonkey/source/xpcom/io/nsIOutputStream.idl#60, the reader for writeSegments is allowed to return success and zero bytes. But, the buffered output stream does not handle that, it looks like it would go into an infinite loop in that case.

This is a quite relevant case since when used via writeFrom, this would hang at EOF (when the input stream would return zero).

Comment 1

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258

Comment 2

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258

Comment 3

[Jens Stutte [:jstutte]]

Bulk-downgrade of unassigned, untouched DOM/Storage bug's priority.

If you have reason to believe, this is wrong, please write a comment and ni :jstutte.

Comment 4

[Valentin Gosu [:valentin]]

I think this bug may still be valid, but not sure how much of an issue it really is in practice.

https://searchfox.org/mozilla-central/rev/cb5faf5dd5176494302068c553da97b4d08aa339/netwerk/base/nsBufferedStreams.cpp#1052-1079

nsBufferedOutputStream::WriteSegments(nsReadSegmentFun reader, void* closure,
                                      uint32_t count, uint32_t* _retval) {
  *_retval = 0;
  nsresult rv;
  RecursiveMutexAutoLock lock(mBufferMutex);
  while (count > 0) {
    uint32_t left = std::min(count, mBufferSize - mCursor);
    if (left == 0) {
      rv = Flush();
      if (NS_FAILED(rv)) {
        return (*_retval > 0) ? NS_OK : rv;
      }

      continue;
    }

    uint32_t read = 0;
    rv = reader(this, closure, mBuffer + mCursor, *_retval, left, &read);

    if (NS_FAILED(rv)) {  // If we have read some data, return ok
      return (*_retval > 0) ? NS_OK : rv;
    }
    mCursor += read;
    *_retval += read;
    count -= read;
    mFillPoint = std::max(mFillPoint, mCursor);
  }
  return NS_OK;