From cea77b76b3fef912bd79e777f97d353aa50474b6 Mon Sep 17 00:00:00 2001 From: "Matt A. Tobin" Date: Sun, 10 Nov 2019 21:59:52 -0500 Subject: Bug 1333038 - Use 'modern' pointers to fix crash due to nsMsgLineStreamBuffer object being deleted while still in use. Suspected "use after free" in nsMsgLineStreamBuffer::ReadNextLine() leading to crash since object may be destroyed while still in use on another thread. Tag #1273 --- mailnews/news/src/nsNNTPProtocol.cpp | 4 ---- mailnews/news/src/nsNNTPProtocol.h | 2 +- 2 files changed, 1 insertion(+), 5 deletions(-) (limited to 'mailnews/news/src') diff --git a/mailnews/news/src/nsNNTPProtocol.cpp b/mailnews/news/src/nsNNTPProtocol.cpp index 7c6314d52..f721e9747 100644 --- a/mailnews/news/src/nsNNTPProtocol.cpp +++ b/mailnews/news/src/nsNNTPProtocol.cpp @@ -271,7 +271,6 @@ nsNNTPProtocol::nsNNTPProtocol(nsINntpIncomingServer *aServer, nsIURI *aURL, NNTP = PR_NewLogModule("NNTP"); m_ProxyServer = nullptr; - m_lineStreamBuffer = nullptr; m_responseText = nullptr; m_dataBuf = nullptr; @@ -305,9 +304,6 @@ nsNNTPProtocol::~nsNNTPProtocol() m_nntpServer->WriteNewsrcFile(); m_nntpServer->RemoveConnection(this); } - if (m_lineStreamBuffer) { - delete m_lineStreamBuffer; - } if (mUpdateTimer) { mUpdateTimer->Cancel(); mUpdateTimer = nullptr; diff --git a/mailnews/news/src/nsNNTPProtocol.h b/mailnews/news/src/nsNNTPProtocol.h index 08db18ee8..6dd3c58de 100644 --- a/mailnews/news/src/nsNNTPProtocol.h +++ b/mailnews/news/src/nsNNTPProtocol.h @@ -197,7 +197,7 @@ private: nsCOMPtr mDisplayInputStream; nsCOMPtr mDisplayOutputStream; - nsMsgLineStreamBuffer * m_lineStreamBuffer; // used to efficiently extract lines from the incoming data stream + RefPtr m_lineStreamBuffer; // used to efficiently extract lines from the incoming data stream // the nsINntpURL that is currently running nsCOMPtr m_runningURL; bool m_connectionBusy; -- cgit v1.2.3