nsDOMWindowUtils::StopFrameTimeRecording() alloc uses sizeof(float*) instead of sizeof(float)

RESOLVED FIXED in mozilla29

Status

()

Core
DOM
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: dveditz, Assigned: lpy)

Tracking

({coverity})

unspecified
mozilla29
x86_64
All
coverity
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [CID 1136628][mentor=jdm][lang=c++][qa-])

Attachments

(1 attachment)

(Reporter)

Description

4 years ago
StopFrameTimeRecording allocates the wrong amount of space, using sizeof(float*) instead of sizeof(float). On 64-bit systems this gives us too big a buffer which is at least the safe direction.

   nsTArray<float> tmpFrameIntervals;
   [...]
-> *frameIntervals = (float*)nsMemory::Alloc(*frameCount * sizeof(float*));
   [...]
   for (uint32_t i = 0; i < *frameCount; i++) {
     (*frameIntervals)[i] = tmpFrameIntervals[i];
   }

Not sure why Coverity just picked that up this scan, it's apparently been like that since bug 826383

Comment 1

4 years ago
http://mxr.mozilla.org/mozilla-central/source/dom/base/nsDOMWindowUtils.cpp
Whiteboard: [CID 1136628] → [CID 1136628][mentor=jdm][lang=c++]
(Assignee)

Comment 2

4 years ago
Created attachment 8361763 [details] [diff] [review]
bug950246.patch

I was wondering why this is not a good first bug?
Assignee: nobody → pylaurent1314
Attachment #8361763 - Flags: review?(josh)

Comment 3

4 years ago
Comment on attachment 8361763 [details] [diff] [review]
bug950246.patch

Redirecting the review to a DOM peer.
Attachment #8361763 - Flags: review?(josh) → review?(khuey)

Comment 4

4 years ago
I just forgot to add the the tag.
(Assignee)

Comment 5

4 years ago
Thank you :)
Attachment #8361763 - Flags: review?(khuey) → review+

Updated

4 years ago
Keywords: checkin-needed
https://hg.mozilla.org/integration/mozilla-inbound/rev/d97fcd278cd2
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/d97fcd278cd2
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla29

Updated

4 years ago
Whiteboard: [CID 1136628][mentor=jdm][lang=c++] → [CID 1136628][mentor=jdm][lang=c++][qa-]
You need to log in before you can comment on or make changes to this bug.