Plug leak in nsTransferable::GetTransferData. b=565392 r=dbaron

widget/src/xpwidgets/nsHTMLFormatConverter.cpp

@@ -21,6 +21,7 @@
  *
  * Contributor(s):
  *   Pierre Phaneuf <pp@ludusdesign.com>
+ *   Mats Palmgren <matpal@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -209,6 +210,8 @@ nsHTMLFormatConverter::Convert(const char *aFromDataFlavor, nsISupports *aFromDa
     return NS_ERROR_INVALID_ARG;
 
   nsresult rv = NS_OK;
+  *aToData = nsnull;
+  *aDataToLen = 0;
 
   if ( !nsCRT::strcmp(aFromDataFlavor, kHTMLMime) ) {
     nsCAutoString toFlavor ( aToDataFlavor );
@@ -253,8 +256,6 @@ nsHTMLFormatConverter::Convert(const char *aFromDataFlavor, nsISupports *aFromDa
       }
     } // else if AOL mail
     else {
-      *aToData = nsnull;
-      *aDataToLen = 0;
       rv = NS_ERROR_FAILURE;
     }
   } // if we got html mime

widget/src/xpwidgets/nsTransferable.cpp

@@ -22,6 +22,7 @@
  * Contributor(s):
  *   Mike Pinkerton (pinkerton@netscape.com)
  *   Dainis Jonitis (Dainis_Jonitis@swh-t.lv)
+ *   Mats Palmgren <matpal@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -315,19 +316,24 @@ nsTransferable::GetTransferData(const char *aFlavor, nsISupports **aData, PRUint
   for (i = 0; i < mDataArray.Length(); ++i ) {
     DataStruct& data = mDataArray.ElementAt(i);
     if ( data.GetFlavor().Equals(aFlavor) ) {
-      data.GetData(aData, aDataLen);
-      if (*aDataLen == kFlavorHasDataProvider) {
+      nsCOMPtr<nsISupports> dataBytes;
+      PRUint32 len;
+      data.GetData(getter_AddRefs(dataBytes), &len);
+      if (len == kFlavorHasDataProvider && dataBytes) {
         // do we have a data provider?
-        nsCOMPtr<nsIFlavorDataProvider> dataProvider = do_QueryInterface(*aData);
+        nsCOMPtr<nsIFlavorDataProvider> dataProvider = do_QueryInterface(dataBytes);
         if (dataProvider) {
-          rv = dataProvider->GetFlavorData(this, aFlavor, aData, aDataLen);
+          rv = dataProvider->GetFlavorData(this, aFlavor,
+                                           getter_AddRefs(dataBytes), &len);
           if (NS_FAILED(rv))
             break;    // the provider failed. fall into the converter code below.
         }
       }
-      if (*aData && *aDataLen > 0)
+      if (dataBytes && len > 0) { // XXXmats why is zero length not ok?
+        *aDataLen = len;
+        dataBytes.forget(aData);
         return NS_OK;
-    
+      }
       break;
     }
   }
@@ -344,11 +350,12 @@ nsTransferable::GetTransferData(const char *aFlavor, nsISupports **aData, PRUint
         nsCOMPtr<nsISupports> dataBytes;
         PRUint32 len;
         data.GetData(getter_AddRefs(dataBytes), &len);
-        if (len == kFlavorHasDataProvider) {
+        if (len == kFlavorHasDataProvider && dataBytes) {
           // do we have a data provider?
           nsCOMPtr<nsIFlavorDataProvider> dataProvider = do_QueryInterface(dataBytes);
           if (dataProvider) {
-            rv = dataProvider->GetFlavorData(this, aFlavor, getter_AddRefs(dataBytes), &len);
+            rv = dataProvider->GetFlavorData(this, aFlavor,
+                                             getter_AddRefs(dataBytes), &len);
             if (NS_FAILED(rv))
               break;  // give up
           }