3620 - Uninitialized memory read in nsRangeList::TakeFocus()

Status: VERIFIED FIXED

(Core :: DOM: Selection, defect, P3)

Description

[Bruce Mitchener]

Uninitialized memory read in nsRangeList::TakeFocus().  The uses of the variable
'beginoffset' in 810 and 807 are initialized in some cases.

While it appears that they are initialized in the call to aFrame->GetSelected(),
there are 2 versions of that method.  The one on nsFrame does not initialize all
of the arguments.  The one on TextFrame does.


line 807:
aFrame->SetSelected(PR_TRUE, beginoffset, aOffset, PR_FALSE);

line 810:
if (beginoffset <= aOffset)

line 806 (apparent initialization):
if (NS_SUCCEEDED(aFrame->GetSelected(&selected, &beginoffset, &endoffset,
&begincontentoffset))){

Comment 1

[mjudge]

fixed! thanks claudius for running purify!!!

Comment 2

[Claudius Gayle]

If only I could take credit for running purify but alas, 'twas not I. On that note, could either the reporter or engineer crank up
purify and verify(and mark it VERIFIED) this bug as I am without the expertise and tools to do so?

Comment 3

[leger]

Per a request from Selection and Search component eng (mjudge) and qa (elig),
moving all "Selection and Search" bugs to new "Selection" component.  Original
"Selection and Search" component will be retired.