Closed Bug 7503 Opened 26 years ago Closed 26 years ago

nsObjectFrame::Reflow uses deleted string

Categories

(Core Graveyard :: Plug-ins, defect, P3)

x86
Windows NT
defect

Tracking

(Not tracked)

VERIFIED FIXED

People

(Reporter: cohn, Assigned: amusil)

Details

In the original version of the code below, extension points into cstring, even after it's deleted. I simply moved the delete call to after extension is used. This code executes whenever an embed tag without a type attribute is parsed. if(!mimeType && src.GetUnicode()) { char* extension; char* cString = src.ToNewCString(); extension = PL_strrchr(cString, '.'); if(extension) ++extension; // delete [] cString; -- RC: delete after use of 'extension' pluginHost->IsPluginEnabledForExtension((const char *)extension, (const char *&)mimeType); delete [] cString; // RC: add after use of 'extension' }
Status: NEW → RESOLVED
Closed: 26 years ago
Resolution: --- → FIXED
Fixed 6.4.99, 3:30PM.
awaiting confirmation of fix from cohn@adobe.com
Status: RESOLVED → VERIFIED
The new fix works with my plug-in.
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.