614445 - delete used to free memory allocated by operator new[] in Ogg backend

Status: RESOLVED FIXED

Description

[cajbir (:cajbir)]

Came across this while looking for something else. Raising bug so I don't forget.

In nsOggCodecState.cpp:

void nsPageQueue::Append(ogg_page* aPage) {
  ...
  p->header = new unsigned char[p->header_len + p->body_len];
  ...
}

PRBool nsOggCodecState::PageInFromBuffer() {
   ...
   ogg_page *p = mBuffer.PeekFront();
   ...
   125   delete p->header;
   ...
}

Comment 1

[cajbir (:cajbir)]

Created attachment 514694 [details] [diff] [review]
Fix

Comment 2

[(Away Sep19-22) Chris Pearce (:cpearce)]

Comment on attachment 514694 [details] [diff] [review]
Fix

We probably need the same for OggPageDeallocator in nsOggCoodecState.h as well?

Comment 3

[cajbir (:cajbir)]

Created attachment 514717 [details] [diff] [review]
Fix

Change delete in nsOggCodecState.h as well.

Comment 4

[cajbir (:cajbir)]

http://hg.mozilla.org/mozilla-central/rev/0a588ac7cda5

Comment 5

[Anthony Hughes (:ashughes)]

Can someone confirm if this is fixed?