Bug 1440926 - Use overflow-checking math when computing Big5 max length. r=emk, a=RyanVM

MozReview-Commit-ID: 1Gney5cYyhu
This commit is contained in:
Henri Sivonen 2018-02-28 14:09:26 -05:00 committed by Roy Tam
commit 128b5dfa13
2 changed files with 26 additions and 7 deletions

View file

@ -152,7 +152,17 @@ nsBIG5ToUnicode::GetMaxLength(const char* aSrc,
{
// The length of the output in UTF-16 code units never exceeds the length
// of the input in bytes.
*aDestLength = aSrcLength + (mPendingTrail ? 1 : 0) + (mBig5Lead ? 1 : 0);
mozilla::CheckedInt32 length = aSrcLength;
if (mPendingTrail) {
length += 1;
}
if (mBig5Lead) {
length += 1;
}
if (!length.isValid()) {
return NS_ERROR_OUT_OF_MEMORY;
}
*aDestLength = length.value();
return NS_OK;
}