From cea77b76b3fef912bd79e777f97d353aa50474b6 Mon Sep 17 00:00:00 2001 From: "Matt A. Tobin" Date: Sun, 10 Nov 2019 21:59:52 -0500 Subject: Bug 1333038 - Use 'modern' pointers to fix crash due to nsMsgLineStreamBuffer object being deleted while still in use. Suspected "use after free" in nsMsgLineStreamBuffer::ReadNextLine() leading to crash since object may be destroyed while still in use on another thread. Tag #1273 --- mailnews/imap/src/nsImapMailFolder.cpp | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'mailnews/imap/src/nsImapMailFolder.cpp') diff --git a/mailnews/imap/src/nsImapMailFolder.cpp b/mailnews/imap/src/nsImapMailFolder.cpp index 4fade9d3f..da1411cd0 100644 --- a/mailnews/imap/src/nsImapMailFolder.cpp +++ b/mailnews/imap/src/nsImapMailFolder.cpp @@ -8379,7 +8379,7 @@ nsImapMailFolder::CopyFileToOfflineStore(nsIFile *srcFile, nsMsgKey msgKey) { // Now, parse the temp file to (optionally) copy to // the offline store for the cur folder. - nsMsgLineStreamBuffer *inputStreamBuffer = + RefPtr inputStreamBuffer = new nsMsgLineStreamBuffer(FILE_IO_BUFFER_SIZE, true, false); int64_t fileSize; srcFile->GetFileSize(&fileSize); @@ -8443,7 +8443,6 @@ nsImapMailFolder::CopyFileToOfflineStore(nsIFile *srcFile, nsMsgKey msgKey) notifier->NotifyMsgsClassified(messages, false, false); inputStream->Close(); inputStream = nullptr; - delete inputStreamBuffer; } if (offlineStore) offlineStore->Close(); -- cgit v1.2.3