1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
|
// This is a crash test for Bug 556351
#include "nsCOMPtr.h"
#include "nsIMimeConverter.h"
#include "nsServiceManagerUtils.h"
#include "prshma.h"
#include "prsystem.h"
#include "TestHarness.h"
nsresult mime_encoder_output_fn(const char* buf, int32_t size, void* closure) {
return NS_OK;
}
nsresult do_test(const char* aBuffer, const uint32_t aSize) {
nsresult rv;
MimeEncoderData* encodeData = nullptr;
int32_t written = 0;
nsCOMPtr<nsIMimeConverter> converter =
do_GetService("@mozilla.org/messenger/mimeconverter;1", &rv);
NS_ENSURE_SUCCESS(rv, rv);
rv = converter->QPEncoderInit(mime_encoder_output_fn, nullptr, &encodeData);
NS_ENSURE_SUCCESS(rv, rv);
rv = converter->EncoderWrite(encodeData, aBuffer, aSize, &written);
NS_ENSURE_SUCCESS(rv, rv);
rv = converter->EncoderDestroy(encodeData, false);
return rv;
}
int main(int argc, char** argv) {
ScopedXPCOM xpcom("TestMimeCrash");
if (xpcom.failed()) return 1;
// We cannot use malloc() since this crashes depends on memory allocation.
// By using mmap()/PR_MemMap(), end of buffer that is last in the page
// sets LF.
uint32_t bufsize = PR_GetPageSize();
PRFileMap* fm = PR_OpenAnonFileMap(".", bufsize, PR_PROT_READWRITE);
if (!fm) return 1;
char* addr = (char*)PR_MemMap(fm, 0, bufsize);
if (!addr) return 1;
memset(addr, '\r', bufsize);
nsresult rv = do_test(addr, bufsize);
PR_MemUnmap(addr, bufsize);
PR_CloseFileMap(fm);
if (NS_FAILED(rv)) {
fail("cannot use nsIMimeConverter error=%08x\n", rv);
return -1;
}
passed("no crash");
return 0;
}
|
