679618 - uninitialized memory in gfx/2d/SourceSurfaceCG.cpp

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[David Volgyes]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:6.0) Gecko/20100101 Firefox/6.0
Build ID: 20110812233755

Steps to reproduce:

cppcheck found this uninitialized memory problem in the code.


Actual results:

in gfx/2d/SourceSurfaceCG.cpp in InitFromData(...) at line #113:

  void *data = malloc(aStride * aSize.height);
  memcpy(aData, data, aStride * aSize.height);

Well, the problem is that:
if you would like copy from data to aData, then data is uninitialized.
(Use calloc, or a memset befopre the copy, etc.)
If you would like copy from aData to data, then the order is wrong.


Expected results:

Fix this uninitialized data problem.

Comment 1

[Josh Matthews [:jdm]]

This is supposed to read memcpy(data, aData, aStride * aSize.height). Is this code actually used? I am amazed this hasn't been noticed before.

Comment 2

[Atul Aggarwal]

Attachment: v1 patch to swap data and aData variable.

This is my patch to mozilla. Please let me know if I am missing something.

Comment 3

[Bas Schouten (:bas.schouten)]

This code is not actually used at this point. As a matter of fact, it isn't even compiled, and it wouldn't compile if you tried to compile it :).

Comment 4

[Ed Morley [:emorley]]

In my queue :-)

Comment 5

[Ed Morley [:emorley]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/5565603c0b7d

Comment 6

[Ed Morley [:emorley]]

http://hg.mozilla.org/mozilla-central/rev/5565603c0b7d

Thanks Atul :-)

Comment 7

[Tobias (:Tobbi) Markus]

Clearing good first bug status to get this off the good first bug buglist!