From cea77b76b3fef912bd79e777f97d353aa50474b6 Mon Sep 17 00:00:00 2001 From: "Matt A. Tobin" Date: Sun, 10 Nov 2019 21:59:52 -0500 Subject: Bug 1333038 - Use 'modern' pointers to fix crash due to nsMsgLineStreamBuffer object being deleted while still in use. Suspected "use after free" in nsMsgLineStreamBuffer::ReadNextLine() leading to crash since object may be destroyed while still in use on another thread. Tag #1273 --- mailnews/base/util/nsMsgLineBuffer.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'mailnews/base/util') diff --git a/mailnews/base/util/nsMsgLineBuffer.h b/mailnews/base/util/nsMsgLineBuffer.h index eff3f7c7e..6bacd45af 100644 --- a/mailnews/base/util/nsMsgLineBuffer.h +++ b/mailnews/base/util/nsMsgLineBuffer.h @@ -70,6 +70,8 @@ class nsIInputStream; class NS_MSG_BASE nsMsgLineStreamBuffer { public: + NS_INLINE_DECL_REFCOUNTING(nsMsgLineStreamBuffer) + // aBufferSize -- size of the buffer you want us to use for buffering stream data // aEndOfLinetoken -- The delimiter string to be used for determining the end of line. This // allows us to parse platform specific end of line endings by making it @@ -83,7 +85,6 @@ public: // lines are terminated with a CR only, you need to set aLineToken to CR ('\r') nsMsgLineStreamBuffer(uint32_t aBufferSize, bool aAllocateNewLines, bool aEatCRLFs = true, char aLineToken = '\n'); // specify the size of the buffer you want the class to use.... - virtual ~nsMsgLineStreamBuffer(); // Caller must free the line returned using PR_Free // aEndOfLinetoken -- delimiter used to denote the end of a line. @@ -93,6 +94,8 @@ public: nsresult GrowBuffer(int32_t desiredSize); void ClearBuffer(); bool NextLineAvailable(); +private: + virtual ~nsMsgLineStreamBuffer(); protected: bool m_eatCRLFs; bool m_allocateNewLines; -- cgit v1.2.3