Bug 551658 - [@ nsIFile::createUnique] crashes with long parent directory names. r=bsmedberg

xpcom/io/nsLocalFileCommon.cpp

@@ -133,9 +133,16 @@ nsLocalFile::CreateUnique(PRUint32 type, PRUint32 attributes)
 
     if (longName)
     {
-        PRUint32 maxRootLength = (kMaxFilenameLength -
-                                  (pathName.Length() - leafName.Length()) -
-                                  suffix.Length() - kMaxSequenceNumberLength);
+        PRInt32 maxRootLength = (kMaxFilenameLength -
+                                 (pathName.Length() - leafName.Length()) -
+                                 suffix.Length() - kMaxSequenceNumberLength);
+
+        // We cannot create an item inside a directory whose name is too long.
+        // Also, ensure that at least one character remains after we truncate
+        // the root name, as we don't want to end up with an empty leaf name.
+        if (maxRootLength < 2)
+            return NS_ERROR_FILE_UNRECOGNIZED_PATH;
+
 #ifdef XP_WIN
         // ensure that we don't cut the name in mid-UTF16-character
         rootName.SetLength(NS_IS_LOW_SURROGATE(rootName[maxRootLength]) ?
@@ -143,9 +150,17 @@ nsLocalFile::CreateUnique(PRUint32 type, PRUint32 attributes)
         SetLeafName(rootName + suffix);
 #else
         if (NS_IsNativeUTF8())
+        {
             // ensure that we don't cut the name in mid-UTF8-character
+            // (assume the name is valid UTF8 to begin with)
             while (UTF8traits::isInSeq(rootName[maxRootLength]))
                 --maxRootLength;
+
+            // Another check to avoid ending up with an empty leaf name.
+            if (maxRootLength == 0 && suffix.IsEmpty())
+                return NS_ERROR_FILE_UNRECOGNIZED_PATH;
+        }
+
         rootName.SetLength(maxRootLength);
         SetNativeLeafName(rootName + suffix);
 #endif

xpcom/tests/unit/test_file_createUnique.js

@@ -0,0 +1,61 @@
+/* -*- Mode: Java; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is XPCOM unit tests.
+ *
+ * The Initial Developer of the Original Code is
+ * Paolo Amadini <http://www.amadzone.org/>.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+const Cc = Components.classes;
+const Ci = Components.interfaces;
+const Cr = Components.results;
+
+function run_test()
+{
+  // Generate a leaf name that is 255 characters long.
+  var longLeafName = new Array(256).join("T");
+
+  // Generate the path for a file located in a directory with a long name.
+  var tempFile = Cc["@mozilla.org/file/directory_service;1"].
+                 getService(Ci.nsIProperties).get("TmpD", Ci.nsIFile);
+  tempFile.append(longLeafName);
+  tempFile.append("test.txt");
+
+  try {
+    tempFile.createUnique(Ci.nsIFile.NORMAL_FILE_TYPE, 0600);
+    do_throw("Creating an item in a folder with a very long name should throw");
+  }
+  catch (e if (e instanceof Ci.nsIException &&
+               e.result == Cr.NS_ERROR_FILE_UNRECOGNIZED_PATH)) {
+    // We expect the function not to crash but to raise this exception.
+  }
+}