46166 - function may return undefined value

Status: RESOLVED FIXED

(NSPR :: NSPR, defect, P3)

Description

[Marcello Nuccio]

Calling function 'PL_Base64Decode()' (defined in
'nsprpub/lib/libc/src/base64.c') with *src == '\0' and srclen == 0,
has undefined behaviour instead of returning *dest == '\0'.

 The bug is in function 'decode()', which, if called with srclen == 0,
does not initialize return value in 'rv'.

Comment 1

[Marcello Nuccio]

Attachment: fix the bug and check for src == NULL

Comment 2

[Wan-Teh Chang]

Fred, could you take a look at this bug? :-)  Thanks.

Comment 3

[Fred Roeber]

The patch looks great.  Someone with a star on his belly, check it in.

Comment 4

[Wan-Teh Chang]

Thanks, Fred.

I checked in the patch on the main trunk.
/cvsroot/mozilla/nsprpub/lib/libc/src/base64.c, revision 3.5

Comment 5

[Hallvard B Furuseth]

The fix is still not in the nightly mozilla build.

(BTW, you might move the default clause in decode()
above 'case 1:', to avoid the gcc warning.)

Comment 6

[Wan-Teh Chang]

The fix is only checked into the tip of NSPR.
Mozilla is using the NSPRPUB_CLIENT_BRANCH of
NSPR, which doesn't have this fix.

Do you think this is an important fix that Mozilla
must pick up now?  Can it wait until Mozilla upgrades
to NSPR 4.1?  (Mozilla is using NSPR 4.0.2 Beta right
now.)

> (BTW, you might move the default clause in decode()
> above 'case 1:', to avoid the gcc warning.)

I don't understand.  Could you explain what the gcc
warning is and why moving the default clause in decode()
above 'case 1:' would avoid it?  Thanks.