601096 - nsTextFormatter's dosprintf always appends an extra \0 (null character), which is redundant when original argument is an nsString

Status: RESOLVED DUPLICATE of bug 323376

(Core :: XPCOM, defect)

Description

[Jonathan Protzenko [:protz]]

So this bug was detected from mailnews's nsMsgUtils.cpp. There's a function called FormatFileSize which calls nsTextFormatter::ssprintf and passes it a nsAString.

The calling chain goes like this: FormatFileSize --> ssprintf --> dosprintf.

dosprintf is the function that actually does all the work, and it appends an extra \0 at the end of the string after its job is done. Because nsAString already has a \0, this causes a duplicate \0. However, this bug went unnoticed because the only caller of FormatFileSize used .get() which actually hides the quirk. That is, until bug 559559, which manipulates the aforementioned string from JS, hence detecting the double null.

We can't just remove the line http://mxr.mozilla.org/comm-central/source/mozilla/xpcom/glue/nsTextFormatter.cpp#1173, because some other functions use dosprintf, namely smprintf, and depend on having the final \0, since they return a bare PRUnichar*.

Please note that I'm just rephrasing NeilAway's explanations, as I'm not XPCOM guru. Any thoughts on how to fix this cleanly?