32861 2009-12-22 01:39:39 -0800 when condition COMPILER(RVCT) is fulfilled, we are trying to free a pointer to array allocated on the stack 2009-12-22 10:44:07 -0800 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) PC Other RESOLVED FIXED P1 Normal --- 0 fridrich.strba webkit-unassigned commit-queue webkit.review.bot oldest_to_newest 174230 0 fridrich.strba 2009-12-22 01:39:39 -0800 The following commit added COMPILER(RVCT) condition to the function and uses vsnprintf on a char[1024] and forgets to add the same condition for not freeing the variable. This might lead to a crash at runtime. 2009-12-21 Kwang Yul Seo <skyul@company100.net> Reviewed by Eric Seidel. Use vsnprintf instead of vasprintf for RVCT. https://bugs.webkit.org/show_bug.cgi?id=32851 RVCT does not support vasprint, so use vsnprintf instead. * dom/XMLTokenizerLibxml2.cpp: (WebCore::XMLTokenizer::error): 174237 1 45377 skyul 2009-12-22 02:23:03 -0800 Created attachment 45377 Ooops. Don't free the pointer for COMPILER(RVCT). 174238 2 webkit.review.bot 2009-12-22 02:24:09 -0800 style-queue ran check-webkit-style on attachment 45377 without any errors. 174299 3 45377 commit-queue 2009-12-22 10:44:03 -0800 Comment on attachment 45377 Ooops. Don't free the pointer for COMPILER(RVCT). Clearing flags on attachment: 45377 Committed r52491: <http://trac.webkit.org/changeset/52491> 174300 4 commit-queue 2009-12-22 10:44:07 -0800 All reviewed patches have been landed. Closing bug. 45377 2009-12-22 02:23:03 -0800 2009-12-22 10:44:03 -0800 Ooops. Don't free the pointer for COMPILER(RVCT). dontfree.patch text/plain 1119 skyul SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA1MjQ4NSkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTUgQEAKKzIwMDktMTItMjIgIEt3YW5nIFl1bCBTZW8gIDxza3l1bEBjb21wYW55 MTAwLm5ldD4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAg ICB3aGVuIGNvbmRpdGlvbiBDT01QSUxFUihSVkNUKSBpcyBmdWxmaWxsZWQsIHdlIGFyZSB0cnlp bmcgdG8gZnJlZSBhIHBvaW50ZXIgdG8gYXJyYXkgYWxsb2NhdGVkIG9uIHRoZSBzdGFjaworICAg ICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MzI4NjEKKworICAg ICAgICBEb24ndCBmcmVlIHRoZSBwb2ludGVyIGZvciBDT01QSUxFUihSVkNUKS4KKworICAgICAg ICAqIGRvbS9YTUxUb2tlbml6ZXJMaWJ4bWwyLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlhNTFRv a2VuaXplcjo6ZXJyb3IpOgorCiAyMDA5LTEyLTIxICBLd2FuZyBZdWwgU2VvICA8c2t5dWxAY29t cGFueTEwMC5uZXQ+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgRXJpYyBTZWlkZWwuCkluZGV4OiBX ZWJDb3JlL2RvbS9YTUxUb2tlbml6ZXJMaWJ4bWwyLmNwcAo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJDb3Jl L2RvbS9YTUxUb2tlbml6ZXJMaWJ4bWwyLmNwcAkocmV2aXNpb24gNTI0ODMpCisrKyBXZWJDb3Jl L2RvbS9YTUxUb2tlbml6ZXJMaWJ4bWwyLmNwcAkod29ya2luZyBjb3B5KQpAQCAtOTEzLDcgKzkx Myw3IEBAIHZvaWQgWE1MVG9rZW5pemVyOjplcnJvcihFcnJvclR5cGUgdHlwZSwKICAgICBlbHNl CiAgICAgICAgIGhhbmRsZUVycm9yKHR5cGUsIG0sIGxpbmVOdW1iZXIoKSwgY29sdW1uTnVtYmVy KCkpOwogCi0jaWYgIUNPTVBJTEVSKE1TVkMpCisjaWYgIUNPTVBJTEVSKE1TVkMpICYmICFDT01Q SUxFUihSVkNUKQogICAgIGZyZWUobSk7CiAjZW5kaWYKIH0K