Date: Mon, 6 Feb 2006 07:57:17 -0800 (PST) From: Don Lewis <truckman@FreeBSD.org> To: FreeBSD-gnats-submit@FreeBSD.org Cc: gnome@FreeBSD.org Subject: ports/92899: firefox-1.5.0.1, 1 uses stack garbage for directory name [patch] Message-ID: <200602061557.k16FvHNC052734@mousie.catspoiler.org> Resent-Message-ID: <200602061600.k16G0MgP009501@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 92899
>Category: ports
>Synopsis: firefox-1.5.0.1,1 uses stack garbage for directory name [patch]
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: freebsd-ports-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Mon Feb 06 16:00:21 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator: Don Lewis
>Release: FreeBSD 4.11-STABLE i386
>Organization:
totally disorganized
>Environment:
System: FreeBSD mousie.catspoiler.org 4.11-STABLE FreeBSD 4.11-STABLE #27: Sat Feb 4 05:21:17 PST 2006 dl@mousie.catspoiler.org:/usr/obj/usr/src/sys/GENERICDDB i386
FreeBSD 4-STABLE, i386
>Description:
Firefox-1.5.0.1,1 stores a directory name in a character array
on the stack. It saves a pointer to that character array and
uses it to access the array contents after the array has gone
out of scope. The old contents seem to get trashed on 4-STABLE,
causing firefox to create a subdirectory under ~/.mozilla with
a name generated from stack garbage.
This problem does not seem to occur on 7-STABLE.
>How-To-Repeat:
Build and run firefox-1.5 on a 4-STABLE, i386 machine.
>Fix:
--- toolkit/xre/nsXREDirProvider.cpp.orig Tue Oct 4 11:46:26 2005
+++ toolkit/xre/nsXREDirProvider.cpp Sun Feb 5 23:54:31 2006
@@ -820,6 +820,7 @@
char* appNameFolder = nsnull;
char profileFolderName[MAXPATHLEN] = ".";
+ char temp[MAXPATHLEN];
// Offset 1 for the outermost folder to make it hidden (i.e. using the ".")
char* writing = profileFolderName + 1;
@@ -829,7 +830,6 @@
rv = localDir->AppendNative(nsDependentCString(profileFolderName));
NS_ENSURE_SUCCESS(rv, rv);
- char temp[MAXPATHLEN];
GetProfileFolderName(temp, gAppData->name);
appNameFolder = temp;
}
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200602061557.k16FvHNC052734>