Bug 20295 – RegularExpression::match should not crash when a null string is passed

• Status: RESOLVED
• Resolution: FIXED
• Component: Text

[Marco Barisione]

RegularExpression::match() passes a null subject string to jsRegExpExecute causing a crash.

See also bug #19794 for a discussion on this.

[Marco Barisione]

Created attachment 22675 [details]
Check for null strings

[Eric Seidel (no email)]

Comment on attachment 22675 [details]
Check for null strings

I found the text "...  with the null string." a bit confusing.  I think that last clause could be removed.   Looks great!

[Jan Alonzo]

Removed the last clause before landing. Landed in r35601

How was this being hit? Is it possible to make a test case? In previous occurrences of this crash, the fix was applied at the call site.

[Marco Barisione]

(In reply to comment #4)
> How was this being hit? Is it possible to make a test case? In previous
> occurrences of this crash, the fix was applied at the call site.

RegularExpression::match is called by DOMImplementation::isXMLMIMEType. Of course the mime type should not be null, this is why I'm also proposing to commit patch #22023 to the CURL backend but IMHO it's a good idea to protect RegularExpression::match from crashing.
If you think that this is not the best idea we could just throw away this patch or I could write a patch to check for null mime types in DOMImplementation::isXMLMIMEType.

[Alp Toker]

Does a two-line null check need a whole new copyright entry?

[Marco Barisione]

(In reply to comment #6)
> Does a two-line null check need a whole new copyright entry?

Actually no, I just did that out of habit.