950246 - nsDOMWindowUtils::StopFrameTimeRecording() alloc uses sizeof(float*) instead of sizeof(float)

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Daniel Veditz [:dveditz]]

StopFrameTimeRecording allocates the wrong amount of space, using sizeof(float*) instead of sizeof(float). On 64-bit systems this gives us too big a buffer which is at least the safe direction.

   nsTArray<float> tmpFrameIntervals;
   [...]
-> *frameIntervals = (float*)nsMemory::Alloc(*frameCount * sizeof(float*));
   [...]
   for (uint32_t i = 0; i < *frameCount; i++) {
     (*frameIntervals)[i] = tmpFrameIntervals[i];
   }

Not sure why Coverity just picked that up this scan, it's apparently been like that since bug 826383

Comment 1

[Josh Matthews [:jdm]]

http://mxr.mozilla.org/mozilla-central/source/dom/base/nsDOMWindowUtils.cpp

Comment 2

[Peiyong Lin[:lpy](UTC+8)]

Attachment: bug950246.patch

I was wondering why this is not a good first bug?

Comment 3

[Josh Matthews [:jdm]]

Comment on attachment 8361763 [details] [diff] [review]
bug950246.patch

Redirecting the review to a DOM peer.

Comment 4

[Josh Matthews [:jdm]]

I just forgot to add the the tag.

Comment 5

[Peiyong Lin[:lpy](UTC+8)]

Thank you :)

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d97fcd278cd2

Comment 7

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/d97fcd278cd2