Closed
Bug 7503
Opened 26 years ago
Closed 26 years ago
nsObjectFrame::Reflow uses deleted string
Categories
(Core Graveyard :: Plug-ins, defect, P3)
Tracking
(Not tracked)
VERIFIED
FIXED
M7
People
(Reporter: cohn, Assigned: amusil)
Details
In the original version of the code below, extension points into cstring, even
after it's deleted. I simply moved the delete call to after extension is used.
This code executes whenever an embed tag without a type attribute is parsed.
if(!mimeType && src.GetUnicode())
{
char* extension;
char* cString = src.ToNewCString();
extension = PL_strrchr(cString, '.');
if(extension)
++extension;
// delete [] cString; -- RC: delete after use of 'extension'
pluginHost->IsPluginEnabledForExtension((const char *)extension, (const
char *&)mimeType);
delete [] cString; // RC: add after use of 'extension'
}
Assignee | ||
Updated•26 years ago
|
Status: NEW → RESOLVED
Closed: 26 years ago
Resolution: --- → FIXED
Assignee | ||
Comment 1•26 years ago
|
||
Fixed 6.4.99, 3:30PM.
Comment 2•25 years ago
|
||
awaiting confirmation of fix from cohn@adobe.com
Reporter | ||
Updated•25 years ago
|
Status: RESOLVED → VERIFIED
Reporter | ||
Comment 3•25 years ago
|
||
The new fix works with my plug-in.
Updated•3 years ago
|
Product: Core → Core Graveyard
You need to log in
before you can comment on or make changes to this bug.
Description
•