Bug 1627440 - fix Crash in nsStreamConverter::OnDataAvailable. r=benc a=wsmwk
authorMagnus Melin <mkmelin+mozilla@iki.fi>
Thu, 04 Jun 2020 13:59:05 +0300
changeset 39367 8d70324cc50fc8404942967057cbc68dbd7751f0
parent 39366 1addcfca7d57d188f8f067c131be1128b47555f2
child 39368 e149840af8ce7284ee53c47d026246dde1b0ac2f
push id402
push userclokep@gmail.com
push dateMon, 29 Jun 2020 20:48:04 +0000
reviewersbenc, wsmwk
bugs1627440
Bug 1627440 - fix Crash in nsStreamConverter::OnDataAvailable. r=benc a=wsmwk
mailnews/mime/src/nsStreamConverter.cpp
--- a/mailnews/mime/src/nsStreamConverter.cpp
+++ b/mailnews/mime/src/nsStreamConverter.cpp
@@ -754,17 +754,16 @@ nsStreamConverter::GetOrigMsgHdr(nsIMsgD
 // method is called whenever data is written into the input stream by the
 // networking library...
 //
 nsresult nsStreamConverter::OnDataAvailable(nsIRequest *request,
                                             nsIInputStream *aIStream,
                                             uint64_t sourceOffset,
                                             uint32_t aLength) {
   nsresult rc = NS_OK;  // should this be an error instead?
-  uint32_t readLen = aLength;
   uint32_t written;
 
   // If this is the first time through and we are supposed to be
   // outputting the wrapper two pane URL, then do it now.
   if (mWrapperOutput) {
     char outBuf[1024];
     const char output[] =
         "\
@@ -781,22 +780,23 @@ nsresult nsStreamConverter::OnDataAvaila
     PR_snprintf(outBuf, sizeof(outBuf), output, url.get(), url.get());
 
     if (mEmitter) mEmitter->Write(nsDependentCString(outBuf), &written);
 
     // rhp: will this stop the stream???? Not sure.
     return NS_ERROR_FAILURE;
   }
 
-  NS_ENSURE_TRUE(aIStream, NS_ERROR_NULL_POINTER);
+  nsCOMPtr<nsIInputStream> stream = aIStream;
+  NS_ENSURE_TRUE(stream, NS_ERROR_NULL_POINTER);
   char *buf = (char *)PR_Malloc(aLength);
   if (!buf) return NS_ERROR_OUT_OF_MEMORY; /* we couldn't allocate the object */
 
-  readLen = aLength;
-  aIStream->Read(buf, aLength, &readLen);
+  uint32_t readLen;
+  stream->Read(buf, aLength, &readLen);
 
   // We need to filter out any null characters else we will have a lot of
   // trouble as we use c string everywhere in mime
   char *readPtr;
   char *endPtr = buf + readLen;
 
   // First let see if the stream contains null characters
   for (readPtr = buf; readPtr < endPtr && *readPtr; readPtr++)