Closed
Bug 719202
Opened 12 years ago
Closed 12 years ago
Possible uninitialised value use in mozilla::imagelib::nsBMPDecoder::WriteInternal
Categories
(Core :: Graphics: ImageLib, defect)
Tracking
()
RESOLVED
FIXED
mozilla12
People
(Reporter: jseward, Assigned: bbondy)
Details
Attachments
(1 file)
851 bytes,
patch
|
joe
:
review+
|
Details | Diff | Splinter Review |
Valgrind reports the error below during startup on x86_64-linux, when running on a 16 bit X display. Happens every startup. ----------------------------------- mozconfig: . $topsrcdir/browser/config/mozconfig mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/ff-opt ac_add_options --disable-libjpeg-turbo ac_add_options --enable-tests ac_add_options --enable-debug-symbols=yes ac_add_options --enable-optimize="-g -O -freorder-blocks" ac_add_options --disable-jemalloc ac_add_options --enable-valgrind mk_add_options MOZ_MAKE_FLAGS="-j4" ----------------------------------- the error itself: Conditional jump or move depends on uninitialised value(s) at 0x61CC6DB: mozilla::imagelib::nsBMPDecoder::WriteInternal(char const*, unsigned int) (image/decoders/nsBMPDecoder.cpp:429) by 0x61AE6E5: mozilla::imagelib::Decoder::Write(char const*, unsigned int) (image/src/Decoder.cpp:112) by 0x61CDBF2: mozilla::imagelib::nsICODecoder::WriteInternal(char const*, unsigned int) (image/decoders/nsICODecoder.cpp:448) by 0x61AE6E5: mozilla::imagelib::Decoder::Write(char const*, unsigned int) (image/src/Decoder.cpp:112) by 0x61B0483: mozilla::imagelib::RasterImage::WriteToDecoder(char const*, unsigned int) (image/src/RasterImage.cpp:2376) by 0x61B058B: mozilla::imagelib::RasterImage::DecodeSomeData(unsigned int) (image/src/RasterImage.cpp:2707) by 0x61B15F9: mozilla::imagelib::imgDecodeWorker::Run() (image/src/RasterImage.cpp:2826) by 0x61B4118: mozilla::imagelib::RasterImage::AddSourceData(char const*, unsigned int) (image/src/RasterImage.cpp:1502) by 0x61B42DC: mozilla::imagelib::RasterImage::WriteToRasterImage(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*) (image/src/RasterImage.cpp:2924) by 0x6CCD42A: nsPipeInputStream::ReadSegments(unsigned int (*)(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*), void*, unsigned int, unsigned int*) (xpcom/io/nsPipe3.cpp:799) by 0x61C14DA: imgRequest::OnDataAvailable(nsIRequest*, nsISupports*, nsIInputStream*, unsigned int, unsigned int) (image/src/imgRequest.cpp:1097) by 0x61B80AF: ProxyListener::OnDataAvailable(nsIRequest*, nsISupports*, nsIInputStream*, unsigned int, unsigned int) (image/src/imgLoader.cpp:2092) Uninitialised value was created by a heap allocation at 0x4029B9A: malloc (/home/sewardj/VgTRUNK/trunk/coregrind/m_replacemalloc/vg_replace_malloc.c:263) by 0x403E058: moz_xmalloc (memory/mozalloc/mozalloc.cpp:103) by 0x61CDB84: mozilla::imagelib::nsICODecoder::WriteInternal(char const*, unsigned int) (ff-opt/image/decoders/../../dist/include/mozilla/mozalloc.h:229) by 0x61AE6E5: mozilla::imagelib::Decoder::Write(char const*, unsigned int) (image/src/Decoder.cpp:112) by 0x61B0483: mozilla::imagelib::RasterImage::WriteToDecoder(char const*, unsigned int) (image/src/RasterImage.cpp:2376) by 0x61B058B: mozilla::imagelib::RasterImage::DecodeSomeData(unsigned int) (image/src/RasterImage.cpp:2707) by 0x61B15F9: mozilla::imagelib::imgDecodeWorker::Run() (image/src/RasterImage.cpp:2826) by 0x61B4118: mozilla::imagelib::RasterImage::AddSourceData(char const*, unsigned int) (image/src/RasterImage.cpp:1502) by 0x61B42DC: mozilla::imagelib::RasterImage::WriteToRasterImage(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*) (image/src/RasterImage.cpp:2924) by 0x6CCD42A: nsPipeInputStream::ReadSegments(unsigned int (*)(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*), void*, unsigned int, unsigned int*) (xpcom/io/nsPipe3.cpp:799) by 0x61C14DA: imgRequest::OnDataAvailable(nsIRequest*, nsISupports*, nsIInputStream*, unsigned int, unsigned int) (image/src/imgRequest.cpp:1097) by 0x61B80AF: ProxyListener::OnDataAvailable(nsIRequest*, nsISupports*, nsIInputStream*, unsigned int, unsigned int) (image/src/imgLoader.cpp:2092)
Assignee | ||
Updated•12 years ago
|
Assignee: nobody → netzen
Comment 1•12 years ago
|
||
How do we get this far into WriteInternal with an uninitialized mBIH? I guess it's possible, but seems unlikely that it missed all the previous uses. https://mxr.mozilla.org/mozilla-central/source/image/decoders/nsBMPDecoder.cpp#429 Looks like a dupe of bug 687982, but that means this should be fixed in Firefox 11 (Nightly and Aurora should have the fix at this point).
Group: core-security
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
Assignee | ||
Comment 2•12 years ago
|
||
I suspect this is also innocuous but is different. I'll verify and re-resolve if it's the same.
Status: RESOLVED → REOPENED
Resolution: DUPLICATE → ---
Assignee | ||
Comment 3•12 years ago
|
||
Attachment #590795 -
Flags: review?(joe)
Assignee | ||
Comment 4•12 years ago
|
||
I easily reproduced and fixed, silly change needed.
Updated•12 years ago
|
Attachment #590795 -
Flags: review?(joe) → review+
Assignee | ||
Comment 5•12 years ago
|
||
http://hg.mozilla.org/integration/mozilla-inbound/rev/66dc5e178691
Target Milestone: --- → mozilla12
Comment 6•12 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/66dc5e178691
Status: REOPENED → RESOLVED
Closed: 12 years ago → 12 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•