Bug 11724 – [S60] 3.1 & 3.2 Memory handling error in CHttpCacheEntry::Internalize(), BrowserCache.dll

• Component: WebKit Misc.
• Status: CLOSED FIXED

[Sachin Padma]

S60_3_1_200638 release, file name \S60\mw\web\WebEngine\OssWebengine\WebKit\ResourceLoader\CacheSrc\HttpCacheEntry.cpp contains the following code...

TInt CHttpCacheEntry::Internalize(
    RFileReadStream& aReadStream )
    {
    TRAPD( err,
     TInt len;
    // url length
    len = aReadStream.ReadInt32L();
    delete iUrl;
    iUrl = HBufC8::NewL( len );	<== if NewL leaves, then iUrl is deleted, but iUrl is not NULL
    TPtr8 ptr8( iUrl->Des() );
    // url
    aReadStream.ReadL( ptr8, len );
    // filename length
    len = aReadStream.ReadInt32L();
    HBufC* filename = HBufC::NewLC( len );
    TPtr ptr( filename->Des() );
    // url
    aReadStream.ReadL( ptr, len );
    //
    SetFileNameL( filename->Des() );
    //
    CleanupStack::PopAndDestroy(); // filename
    // la
    TReal64 la;
    la = aReadStream.ReadReal64L();
    iLastAccessed = la;
    // ref
    iRef = aReadStream.ReadUint32L();
    // size
    iSize = aReadStream.ReadUint32L( );
    // size
    iHeaderSize = aReadStream.ReadUint32L( );
    // protected
    iProtected = aReadStream.ReadInt32L();
    //
    SetState( ECacheComplete ); );
    return err;
    }

... and this causes problems after CHttpCacheEntry destructor is run, because it deletes the same heap-allocated iUrl again.

[Sachin Padma]

TSW ID:  THYN-6VJCRE

[Sachin Padma]

Created attachment 11684 [details]
fix url not set null of deleting

[Yongjun Zhang]

Comment on attachment 11684 [details]
fix url not set null of deleting

r=me

[Sachin Padma]

committed as r17943

[Krishna]

Verified and Closed.

[Joel Parks]

re-purposing InTSW keyword for use by QtWebkit team