Bug 548719 - CFStringCreateWithCString() and CFStringCreateWithBytes() can return NULL without having run out of memory. r=josh

uriloader/exthandler/mac/nsOSHelperAppService.mm

@@ -100,11 +100,16 @@ nsOSHelperAppService::~nsOSHelperAppService()
 
 nsresult nsOSHelperAppService::OSProtocolHandlerExists(const char * aProtocolScheme, PRBool * aHandlerExists)
 {
+  // CFStringCreateWithBytes() can fail even if we're not out of memory --
+  // for example if the 'bytes' parameter is something very wierd (like "ÿÿ~"
+  // aka "\xFF\xFF~"), or possibly if it can't be interpreted as using what's
+  // specified in the 'encoding' parameter.  See bug 548719.
   CFStringRef schemeString = ::CFStringCreateWithBytes(kCFAllocatorDefault,
                                                        (const UInt8*)aProtocolScheme,
                                                        strlen(aProtocolScheme),
                                                        kCFStringEncodingUTF8,
                                                        false);
+  if (schemeString) {
     // LSCopyDefaultHandlerForURLScheme() can fail to find the default handler
     // for aProtocolScheme when it's never been explicitly set (using
     // LSSetDefaultHandlerForURLScheme()).  For example, Safari is the default
@@ -120,6 +125,9 @@ nsresult nsOSHelperAppService::OSProtocolHandlerExists(const char * aProtocolSch
     if (handlerArray)
       ::CFRelease(handlerArray);
     ::CFRelease(schemeString);
+  } else {
+    *aHandlerExists = PR_FALSE;
+  }
   return NS_OK;
 }
 
@@ -270,7 +278,12 @@ nsOSHelperAppService::GetMIMEInfoFromOS(const nsACString& aMIMEType,
 
   if (!aMIMEType.IsEmpty()) {
     CFURLRef appURL = NULL;
+    // CFStringCreateWithCString() can fail even if we're not out of memory --
+    // for example if the 'cStr' parameter is something very wierd (like "ÿÿ~"
+    // aka "\xFF\xFF~"), or possibly if it can't be interpreted as using what's
+    // specified in the 'encoding' parameter.  See bug 548719.
     CFStringRef CFType = ::CFStringCreateWithCString(NULL, flatType.get(), kCFStringEncodingUTF8);
+    if (CFType) {
       err = ::LSCopyApplicationForMIMEType(CFType, kLSRolesAll, &appURL);
       if ((err == noErr) && appURL && ::CFURLGetFSRef(appURL, &typeAppFSRef)) {
         haveAppForType = PR_TRUE;
@@ -280,14 +293,22 @@ nsOSHelperAppService::GetMIMEInfoFromOS(const nsACString& aMIMEType,
         ::CFRelease(appURL);
       ::CFRelease(CFType);
     }
+  }
   if (!aFileExt.IsEmpty()) {
+    // CFStringCreateWithCString() can fail even if we're not out of memory --
+    // for example if the 'cStr' parameter is something very wierd (like "ÿÿ~"
+    // aka "\xFF\xFF~"), or possibly if it can't be interpreted as using what's
+    // specified in the 'encoding' parameter.  See bug 548719.
     CFStringRef CFExt = ::CFStringCreateWithCString(NULL, flatExt.get(), kCFStringEncodingUTF8);
+    if (CFExt) {
       err = ::LSGetApplicationForInfo(kLSUnknownType, kLSUnknownCreator, CFExt,
                                       kLSRolesAll, &extAppFSRef, nsnull);
       if (err == noErr) {
         haveAppForExt = PR_TRUE;
         PR_LOG(mLog, PR_LOG_DEBUG, ("LSGetApplicationForInfo found a default application\n"));
       }
+      ::CFRelease(CFExt);
+    }
   }
 
   if (haveAppForType && haveAppForExt) {