710989 - Possible memset underflow in Time::Explode()

Status: RESOLVED FIXED

(Core :: IPC, defect)

Description

[Justin Dolske [:Dolske]]

From http://www.viva64.com/en/a/0078/,
6th section in http://www.viva64.com/external-pictures/txt/mozilla-test.txt

V512 A call of the 'memset' function will lead to underflow of the buffer '(exploded)'.
time_win.cc 198

void Time::Explode(bool is_local, Exploded* exploded) const {
  ...
  ZeroMemory(exploded, sizeof(exploded));
  ...
}

I think there could be written like this.
ZeroMemory(exploded, sizeof(*exploded));

Comment 1

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

I don't think we use Time for anything in gecko, but this is probably fixed upstream in chromium.  If not we should file there too.

Comment 2

[Charles Chan]

(In reply to Chris Jones [:cjones] [:warhammer] from comment #1)
> I don't think we use Time for anything in gecko, but this is probably fixed
> upstream in chromium.  If not we should file there too.

Yes. It appears the issue has already been resolved in Chromium. See ~Line 255
http://src.chromium.org/viewvc/chrome/trunk/src/base/time_win.cc?view=annotate

Comment 3

[Charles Chan]

Just out of curiosity, why is there a copy of the Chromium src within the Mozilla source code?

Comment 4

[Charles Chan]

Attachment: Bug 710989: Patch-1

Fix the ZeroMemory() issue in the Mozilla src tree, please review.

Comment 5

[Justin Dolske [:Dolske]]

Comment on attachment 608963 [details] [diff] [review]
Bug 710989: Patch-1

This is in Chris's area, so moving review.

Thanks for the patch!

Comment 6

[Jared Wein [:jaws] (please needinfo? me)]

(In reply to Charles Chan from comment #3)
> Just out of curiosity, why is there a copy of the Chromium src within the
> Mozilla source code?

Gecko uses Chromium's inter-process communication library. Here is a link to a list of third-party code located in the tree: https://wiki.mozilla.org/ThirdPartyCode

Comment 7

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Comment on attachment 608963 [details] [diff] [review]
Bug 710989: Patch-1

Sorry for the review latency.

Comment 8

[Josh Matthews [:jdm]]

Oops. I'll see if this is still valid on trunk.

Comment 9

[Josh Matthews [:jdm]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4de05e48b784

Comment 10

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

https://hg.mozilla.org/mozilla-central/rev/4de05e48b784