wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 1170809 - Improve the buffer size check in nsXMLHttpRequest::AppendToResponseText. r=ehsan, r=bz

Browse Source
This commit is contained in:
Andrea Marchesini 2015-06-23 10:47:38 -04:00
parent 606d29044e
commit 67cc340ec1
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
dom/base/nsXMLHttpRequest.cpp
View File

@ -678,13 +678,18 @@ nsXMLHttpRequest::AppendToResponseText(const char * aSrcBuffer,
&destBufferLen); &destBufferLen);
NS_ENSURE_SUCCESS(rv, rv); NS_ENSURE_SUCCESS(rv, rv);
if (!mResponseText.SetCapacity(mResponseText.Length() + destBufferLen, fallible)) { uint32_t size = mResponseText.Length() + destBufferLen;
if (size < (uint32_t)destBufferLen) {
return NS_ERROR_OUT_OF_MEMORY;
}
if (!mResponseText.SetCapacity(size, fallible)) {
return NS_ERROR_OUT_OF_MEMORY; return NS_ERROR_OUT_OF_MEMORY;
} }
char16_t* destBuffer = mResponseText.BeginWriting() + mResponseText.Length(); char16_t* destBuffer = mResponseText.BeginWriting() + mResponseText.Length();
int32_t totalChars = mResponseText.Length(); CheckedInt32 totalChars = mResponseText.Length();
// This code here is basically a copy of a similar thing in // This code here is basically a copy of a similar thing in
// nsScanner::Append(const char* aBuffer, uint32_t aLen). // nsScanner::Append(const char* aBuffer, uint32_t aLen).
@ -697,9 +702,11 @@ nsXMLHttpRequest::AppendToResponseText(const char * aSrcBuffer,
MOZ_ASSERT(NS_SUCCEEDED(rv)); MOZ_ASSERT(NS_SUCCEEDED(rv));
totalChars += destlen; totalChars += destlen;
if (!totalChars.isValid()) {
return NS_ERROR_OUT_OF_MEMORY;
}
mResponseText.SetLength(totalChars); mResponseText.SetLength(totalChars.value());
return NS_OK; return NS_OK;
} }