65617 - unsecure use of new operator in nsPresShell.cpp

Status: VERIFIED FIXED

(Core :: Layout, defect, P1)

Description

[Bernd]

http://lxr.mozilla.org/seamonkey/source/layout/html/base/src/nsPresShell.cpp#147
3 shows the typical pattern described in bug 8227 and should be fixed.

if mStackArena is 0 ....

PresShell::PushStackMemory()
1471 {
1472   if (nsnull == mStackArena)
1473      mStackArena = new StackArena();
1474    
1475   return mStackArena->Push();
1476 }

Comment 1

[Peter Trudelle]

->dr/moz0.9.1

Comment 2

[Dan Rosen]

Okay, there's a buttload of these, starting around line 1480 or so. I'll
basically just change them all to look like:

PresShell::Foo() {
  nsresult result = NS_OK;
  if (!mStackArena)
    mStackArena = new StackArena();
  if (!mStackArena) // allocation failed
    result = NS_MEMORY_ALLOCATION_ERROR;
  else
    result = mStackArena->Foo();
  return result;
}

Comment 3

[Dan Rosen]

Attachment: patch to nsPresShell.cpp protecting memory allocations

Comment 4

[Dan Rosen]

Attachment: Revised patch per jag & scc

Comment 5

[Peter "jag" Annema]

Hrm... No, I like the first one better. r=jag on the first. Sorry about that.

Comment 6

[Simon Fraser [no longer active]]

I prefer the first one, but would like to see

+    if (!mStackArena) return NS_ERROR_OUT_OF_MEMORY;

replaced by 

+    if (!mStackArena)
+      return NS_ERROR_OUT_OF_MEMORY;

to make debugging easier.

sr=sfraser

Comment 7

[Dan Rosen]

fixed (first patch, with smfr's changes). rev 3.396.

Comment 8

[Chris Petersen]

Marking verified per last comments