Null pointer dereference when saving ftp resource to disk Topic is solved

[Veit Kannegieser]

Hello,
i see Pale Moon debian, 64 bit closing when saving a ftp resource to local disk.
Starting in safe mode, or creating a new profile did not help.
I work with local ftp servers here, but it is also reproducible using
<ftp://ftp.elf.stuba.sk/HEADER.txt>

[vannilla]

I'm not getting anything when I try to save the file to disk.
Can you tell us the steps you take when it happens?

[Moonchild]

Confirmed, this is a crash in the DOM security check for ftp subresource loading.
You can work around it by disabling the crashing check: Set pref security.block_ftp_subresources to false.
Opened Issue #1710 (UXP) to track this.

[vannilla]

After reading the issue description I got the crash too.
In my previous message I used the "Save Link As..." entry of the context menu on the provided link, so until the fix is out you can also work around the crash that way, if you don't want to mess with about:config.

[New Tobin Paradigm]

Even worse for me cause reasons I outlined in the issue.

[Moonchild]

Crash fix will be in the next release.

[vicyclefive]

1

You have a race condition:

You call f.isDirectory(), which returns true.
I replace the directory at path with some ordinary file.
You call f.listFiles(), which returns null.
To avoid this, say File[] files = f.listFiles(); unconditionally, and then change your if to if (files != null).

[Moonchild]

Not sure what your post is about because it's lacking all context -- and has nothing at all to do with the code where this crash occurred.

[vannilla]

I think it's about non-atomic file operations, in that if the process scheduler swaps processes between the isDirectory and listFiles calls, a malicious process can create a failure in the browser.
Of course this does not explain why it was posted in this thread.

[Veit Kannegieser]

Crash fix will be in the next release.

Works nice in 29.0.0.
Thank you!