summaryrefslogtreecommitdiffstats
path: root/mailnews/news
diff options
context:
space:
mode:
authorMatt A. Tobin <email@mattatobin.com>2019-11-10 21:59:52 -0500
committerMatt A. Tobin <email@mattatobin.com>2019-11-10 21:59:52 -0500
commitcea77b76b3fef912bd79e777f97d353aa50474b6 (patch)
tree5f4792d164e62e4b9a257811dd259cc40c053683 /mailnews/news
parent05667b0d48b50f434ea48a3065adea6c0a88f226 (diff)
downloadUXP-cea77b76b3fef912bd79e777f97d353aa50474b6.tar
UXP-cea77b76b3fef912bd79e777f97d353aa50474b6.tar.gz
UXP-cea77b76b3fef912bd79e777f97d353aa50474b6.tar.lz
UXP-cea77b76b3fef912bd79e777f97d353aa50474b6.tar.xz
UXP-cea77b76b3fef912bd79e777f97d353aa50474b6.zip
Bug 1333038 - Use 'modern' pointers to fix crash due to nsMsgLineStreamBuffer object being deleted while still in use.
Suspected "use after free" in nsMsgLineStreamBuffer::ReadNextLine() leading to crash since object may be destroyed while still in use on another thread. Tag #1273
Diffstat (limited to 'mailnews/news')
-rw-r--r--mailnews/news/src/nsNNTPProtocol.cpp4
-rw-r--r--mailnews/news/src/nsNNTPProtocol.h2
2 files changed, 1 insertions, 5 deletions
diff --git a/mailnews/news/src/nsNNTPProtocol.cpp b/mailnews/news/src/nsNNTPProtocol.cpp
index 7c6314d52..f721e9747 100644
--- a/mailnews/news/src/nsNNTPProtocol.cpp
+++ b/mailnews/news/src/nsNNTPProtocol.cpp
@@ -271,7 +271,6 @@ nsNNTPProtocol::nsNNTPProtocol(nsINntpIncomingServer *aServer, nsIURI *aURL,
NNTP = PR_NewLogModule("NNTP");
m_ProxyServer = nullptr;
- m_lineStreamBuffer = nullptr;
m_responseText = nullptr;
m_dataBuf = nullptr;
@@ -305,9 +304,6 @@ nsNNTPProtocol::~nsNNTPProtocol()
m_nntpServer->WriteNewsrcFile();
m_nntpServer->RemoveConnection(this);
}
- if (m_lineStreamBuffer) {
- delete m_lineStreamBuffer;
- }
if (mUpdateTimer) {
mUpdateTimer->Cancel();
mUpdateTimer = nullptr;
diff --git a/mailnews/news/src/nsNNTPProtocol.h b/mailnews/news/src/nsNNTPProtocol.h
index 08db18ee8..6dd3c58de 100644
--- a/mailnews/news/src/nsNNTPProtocol.h
+++ b/mailnews/news/src/nsNNTPProtocol.h
@@ -197,7 +197,7 @@ private:
nsCOMPtr<nsIAsyncInputStream> mDisplayInputStream;
nsCOMPtr<nsIAsyncOutputStream> mDisplayOutputStream;
- nsMsgLineStreamBuffer * m_lineStreamBuffer; // used to efficiently extract lines from the incoming data stream
+ RefPtr<nsMsgLineStreamBuffer> m_lineStreamBuffer; // used to efficiently extract lines from the incoming data stream
// the nsINntpURL that is currently running
nsCOMPtr<nsINntpUrl> m_runningURL;
bool m_connectionBusy;