3577 - invalid pointer reading in NSPR?

Status: VERIFIED INVALID

(NSPR :: NSPR, defect, P3)

Description

[Bruce Mitchener]

2 errors... mozilla pull from evening (PST) of March 9, 1999.  NSPR pull and
build from March 8, 1999.  Solaris 2.6, gcc 2.7.2.3, purify.

****  Purify instrumented ./apprunner.pure (pid 1154)  ****
IPR: Invalid pointer read:
  * This is occurring while in:
        strlen         [rtlib.o]
        DLLErrorInternal [prlink.c:131]
        PR_LoadLibrary [prlink.c:732]
        nsDll::Load()  [xcDll.cpp:150]
        nsComponentManagerImpl::LoadFactory(nsFactoryEntry*,nsIFactory**)
[nsComponentManager.cpp:797]
        nsComponentManagerImpl::FindFactory(const nsID&,nsIFactory**)
[nsComponentManager.cpp:903]
        nsComponentManagerImpl::CreateInstance(const nsID&,nsISupports*,const
nsID&,void**) [nsComponentManager.cpp:1061]
        nsComponentManager::CreateInstance(const nsID&,nsISupports*,const
nsID&,void**) [nsRepository.cpp:67]
        nsServiceManagerImpl::GetService(const nsID&,const
nsID&,nsISupports**,nsIShutdownListener*) [nsServiceManager.cpp:229]
        nsServiceManager::GetService(const nsID&,const
nsID&,nsISupports**,nsIShutdownListener*) [nsServiceManager.cpp:391]
        nsWebShell::CreatePluginHost(int) [nsWebShell.cpp:406]
        nsWebShell::Init(void*,int,int,int,int,nsScrollPreference,int,int)
[nsWebShell.cpp:727]

nsWebShellWindow::Initialize(nsIWidget*,nsIAppShell*,nsIURL*,nsString&,nsIStream
Observer*,nsIXULWindowCallbacks*,int,int) [nsWebShellWindow.cpp:227]

nsAppShellService::CreateTopLevelWindow(nsIWidget*,nsIURL*,nsString&,nsIWidget*&
,nsIStreamObserver*,nsIXULWindowCallbacks*,int,int) [nsAppShellService.cpp:233]
        main           [nsAppRunner.cpp:275]
        _start         [crt1.o]
  * Reading 90 bytes from 0xebb3062c between the heap and the stack.

****  Purify instrumented ./apprunner.pure (pid 1154)  ****
IPR: Invalid pointer read:
  * This is occurring while in:
        memcpy         [rtlib.o]
        PR_SetErrorText [prerror.c:69]
        DLLErrorInternal [prlink.c:131]
        PR_LoadLibrary [prlink.c:732]
        nsDll::Load()  [xcDll.cpp:150]
        nsComponentManagerImpl::LoadFactory(nsFactoryEntry*,nsIFactory**)
[nsComponentManager.cpp:797]
        nsComponentManagerImpl::FindFactory(const nsID&,nsIFactory**)
[nsComponentManager.cpp:903]
        nsComponentManagerImpl::CreateInstance(const nsID&,nsISupports*,const
nsID&,void**) [nsComponentManager.cpp:1061]
        nsComponentManager::CreateInstance(const nsID&,nsISupports*,const
nsID&,void**) [nsRepository.cpp:67]
        nsServiceManagerImpl::GetService(const nsID&,const
nsID&,nsISupports**,nsIShutdownListener*) [nsServiceManager.cpp:229]
        nsServiceManager::GetService(const nsID&,const
nsID&,nsISupports**,nsIShutdownListener*) [nsServiceManager.cpp:391]
        nsWebShell::CreatePluginHost(int) [nsWebShell.cpp:406]
        nsWebShell::Init(void*,int,int,int,int,nsScrollPreference,int,int)
[nsWebShell.cpp:727]

nsWebShellWindow::Initialize(nsIWidget*,nsIAppShell*,nsIURL*,nsString&,nsIStream
Observer*,nsIXULWindowCallbacks*,int,int) [nsWebShellWindow.cpp:227]

nsAppShellService::CreateTopLevelWindow(nsIWidget*,nsIURL*,nsString&,nsIWidget*&
,nsIStreamObserver*,nsIXULWindowCallbacks*,int,int) [nsAppShellService.cpp:233]
        main           [nsAppRunner.cpp:275]
        _start         [crt1.o]
  * Reading 90 bytes from 0xebb3062c between the heap and the stack.

Comment 1

[Wan-Teh Chang]

New bugs should be assigned to
module owners.

Comment 2

[srinivas]

The system function dlerror() is called when the dlopen() call from
PR_LoadLibrary fails to load the library (most likely, either because the
library doesn't exist or incorrect path to the library is used).Dlerror() should
return either a pointer to a null-terminated string or NULL. The nspr function
DLLErrorInternal() passes the non-NULL string pointer from dlopen() to strlen
and memcpy.

I could reproduce this purify warning by trying to load a non-existent library.
The problem appears to be either

1. purify incorrectly reporting a IPR error or
2. the dlerror() function in the Solaris libdl library returning a pointer to
invalid memory.

Comment 3

[Terry Weissman]

NSPR now has its own Bugzilla product.  Moving this bug to the NSPR product.

Comment 4

[srinivas]

The pointer returned by dlerror() is from a valid memory address; the truss
output shows the corresponding mmap call.

This bug should be closed as invalid.

Comment 5

[Jay Patel [:jay]]

verified invalid