fix for bug 19590, writing to nil during a drag. Also fixed a memory corruptor with deleting bad memory when there was no flavor mapping table (no bug filed). r=sfraser.

git-svn-id: svn://10.0.0.236/trunk@54326 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/widget/src/mac/nsClipboard.cpp

@@ -133,10 +133,12 @@ nsClipboard :: SetNativeClipboardData()
   // includes the NULL terminator.
   short mappingLen = 0;
   const char* mapping = theMapper.ExportMapping(&mappingLen);
-  long numBytes = ::PutScrap ( mappingLen, nsMimeMapperMac::MappingFlavor(), mapping );
-  if ( numBytes != noErr )
-    errCode = NS_ERROR_FAILURE;
-  nsCRT::free ( NS_CONST_CAST(char*, mapping) );
+  if ( mapping && mappingLen ) {
+    long numBytes = ::PutScrap ( mappingLen - 1, nsMimeMapperMac::MappingFlavor(), mapping );
+    if ( numBytes != noErr )
+      errCode = NS_ERROR_FAILURE;
+    nsCRT::free ( NS_CONST_CAST(char*, mapping) );
+  }
   
   return errCode;
   

mozilla/widget/src/mac/nsDragService.cpp

@@ -227,15 +227,17 @@ nsDragService :: RegisterDragItemsAndFlavors ( nsISupportsArray * inArray )
     
     // put the mime mapping data for this item in a special flavor. Unlike the other data,
     // we have to put the data in now (rather than defer it) or the mappings will go out 
-    // of scope by the time they are asked for.
-    char* mapping = theMapper.ExportMapping(nsnull);
-    if ( strlen(mapping) )
+    // of scope by the time they are asked for. Remember that the |mappingLen|
+    // includes the null.
+    short mappingLen;
+    char* mapping = theMapper.ExportMapping(&mappingLen);
+    if ( mapping && mappingLen ) {
       ::AddDragItemFlavor ( mDragRef, itemIndex, nsMimeMapperMac::MappingFlavor(), 
-                               mapping, strlen(mapping), flags );
-	nsCRT::free ( mapping );
+                               mapping, mappingLen - 1, flags );
+	  nsCRT::free ( mapping );
+	}
     
-  } // foreach drag item
-  
+  } // foreach drag item 
 
 } // RegisterDragItemsAndFlavors
 

mozilla/widget/src/mac/nsMimeMapper.cpp

@@ -140,14 +140,17 @@ nsMimeMapperMac :: MapMacOSTypeToMimeType ( ResType inMacType, nsCAutoString & o
 // ParseMappings
 //
 // The mappings are of the form
-//   1..N of (<4 char code> <space> <mime type>)
+//   1..N of (<4 char code> <space> <mime type>).
+//
+// It is perfectly acceptable for there to be no mappings (either |inMappings|
+// is null or an emtpy string).
 //
 void
 nsMimeMapperMac :: ParseMappings ( const char* inMappings )
 {
   if ( !inMappings )
     return;
-    
+
   const char* currPosition = inMappings;
   while ( *currPosition ) {
     char mimeType[100];
@@ -176,6 +179,10 @@ nsMimeMapperMac :: ParseMappings ( const char* inMappings )
 char*
 nsMimeMapperMac :: ExportMapping ( short * outLength ) const
 {
+  NS_WARN_IF_FALSE ( outLength, "No out param provided" );
+  if ( outLength )
+    *outLength = 0;
+
 #if 0
 // I'm leaving this code in here just to prove a point. If we were allowed to
 // use string stream's (we're not, because of bloat), this is all the code I'd have
@@ -202,32 +209,34 @@ nsMimeMapperMac :: ExportMapping ( short * outLength ) const
     len += it->second.Length();  // <mime type>
   }  
 
-  // create a string of that length and fill it in with each mapping
+  // create a string of that length and fill it in with each mapping. We have to
+  // consider the possibility that there aren't any generic (internal mozilla) flavors
+  // so the map could be empty.
+  exportBuffer = NS_STATIC_CAST(char*, nsAllocator::Alloc(len + 1));      // don't forget the NULL
+  if ( !exportBuffer )
+    return nsnull;
+  *exportBuffer = '\0';                          // null terminate at the start for strcat()
   if ( len ) {
-    exportBuffer = new char[len + 1];              // don't forget the NULL
-    if ( exportBuffer ) { 
-      *exportBuffer = '\0';                        // null terminate at the start for strcat()
-      
-      char* posInString = exportBuffer;
-      for ( MimeMapConstIterator it = mMappings.begin(); it != mMappings.end(); ++it ) {
-        // create a buffer for this mapping, fill it in, and append it to our
-        // ongoing result buffer, |exportBuffer|. 
-        char* currMapping = new char[10 + 2 + it->second.Length() + 1];  // same computation as above, plus NULL
-        const char* mimeType = it->second.ToNewCString();
-        if ( currMapping && mimeType ) {
-          sprintf(currMapping, "%ld %s ", it->first, mimeType);
-          strcat(posInString, currMapping);
-          posInString += strlen(currMapping);     // advance marker to get ready for next mapping
-        }
-        delete [] mimeType;
-        delete [] currMapping;
+    char* posInString = exportBuffer;
+    for ( MimeMapConstIterator it = mMappings.begin(); it != mMappings.end(); ++it ) {
+      // create a buffer for this mapping, fill it in, and append it to our
+      // ongoing result buffer, |exportBuffer|. 
+      char* currMapping = new char[10 + 2 + it->second.Length() + 1];  // same computation as above, plus NULL
+      char* mimeType = it->second.ToNewCString();
+      if ( currMapping && mimeType ) {
+        sprintf(currMapping, "%ld %s ", it->first, mimeType);
+        strcat(posInString, currMapping);
+        posInString += strlen(currMapping);     // advance marker to get ready for next mapping
       }
+      nsCRT::free ( mimeType );
+      nsCRT::free ( currMapping );
+    }
       
-      *posInString = '\0';                        // null terminate our resulting string
-    } // if we got the memory
+    *posInString = '\0';                        // null terminate our resulting string
   } // if there is anything in our list
   
-  *outLength = len + 1;  // don't forget the NULL
+  if ( outLength )
+    *outLength = len + 1;  // don't forget the NULL
   return exportBuffer;
   
 } // ExportMapping