wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-22 23:27:30 +09:00
Code Issues Projects Releases Packages Wiki Activity

Fix ReadCompressedIndexDataValuesFromBlob().

Browse source
This commit is contained in:
wolfbeast 2017-10-06 13:23:44 +02:00 • committed by Roy Tam
commit 2c29b5a5c1
1 changed files with 10 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
dom/indexedDB/ActorsParent.cpp
View file

@ -7,6 +7,7 @@
#include "ActorsParent.h" #include "ActorsParent.h"
#include <algorithm> #include <algorithm>
#include <stdint.h> // UINTPTR_MAX, uintptr_t
#include "FileInfo.h" #include "FileInfo.h"
#include "FileManager.h" #include "FileManager.h"
#include "IDBObjectStore.h" #include "IDBObjectStore.h"
@ -859,6 +860,11 @@ ReadCompressedIndexDataValuesFromBlob(const uint8_t* aBlobData,
"ReadCompressedIndexDataValuesFromBlob", "ReadCompressedIndexDataValuesFromBlob",
js::ProfileEntry::Category::STORAGE); js::ProfileEntry::Category::STORAGE);
if (uintptr_t(aBlobData) > UINTPTR_MAX - aBlobDataLength) {
IDB_REPORT_INTERNAL_ERR();
return NS_ERROR_FILE_CORRUPTED;
}
const uint8_t* blobDataIter = aBlobData; const uint8_t* blobDataIter = aBlobData;
const uint8_t* blobDataEnd = aBlobData + aBlobDataLength; const uint8_t* blobDataEnd = aBlobData + aBlobDataLength;
@ -878,7 +884,8 @@ ReadCompressedIndexDataValuesFromBlob(const uint8_t* aBlobData,
if (NS_WARN_IF(blobDataIter == blobDataEnd) || if (NS_WARN_IF(blobDataIter == blobDataEnd) ||
NS_WARN_IF(keyBufferLength > uint64_t(UINT32_MAX)) || NS_WARN_IF(keyBufferLength > uint64_t(UINT32_MAX)) ||
NS_WARN_IF(blobDataIter + keyBufferLength > blobDataEnd)) { NS_WARN_IF(keyBufferLength > uintptr_t(blobDataEnd)) ||
NS_WARN_IF(blobDataIter > blobDataEnd - keyBufferLength)) {
IDB_REPORT_INTERNAL_ERR(); IDB_REPORT_INTERNAL_ERR();
return NS_ERROR_FILE_CORRUPTED; return NS_ERROR_FILE_CORRUPTED;
} }
@ -896,7 +903,8 @@ ReadCompressedIndexDataValuesFromBlob(const uint8_t* aBlobData,
if (sortKeyBufferLength > 0) { if (sortKeyBufferLength > 0) {
if (NS_WARN_IF(blobDataIter == blobDataEnd) || if (NS_WARN_IF(blobDataIter == blobDataEnd) ||
NS_WARN_IF(sortKeyBufferLength > uint64_t(UINT32_MAX)) || NS_WARN_IF(sortKeyBufferLength > uint64_t(UINT32_MAX)) ||
NS_WARN_IF(blobDataIter + sortKeyBufferLength > blobDataEnd)) { NS_WARN_IF(sortKeyBufferLength > uintptr_t(blobDataEnd)) ||
NS_WARN_IF(blobDataIter > blobDataEnd - sortKeyBufferLength)) {
IDB_REPORT_INTERNAL_ERR(); IDB_REPORT_INTERNAL_ERR();
return NS_ERROR_FILE_CORRUPTED; return NS_ERROR_FILE_CORRUPTED;
} }