wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-24 08:07:30 +09:00
Code Issues Projects Releases Packages Wiki Activity

[XPCOM] Crash safely when TArray replacements are OOB.

Browse source 
In the unlikely event of TArray element replacement calls are OOB, crash safely
with a debug breakpoint instead of corrupting memory.
This commit is contained in:
Moonchild 2022-07-03 15:38:40 +00:00 • committed by roytam1
commit 37d0ffa172
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
xpcom/glue/nsTArray.h
View file

@ -2018,6 +2018,12 @@ auto
nsTArray_Impl<E, Alloc>::ReplaceElementsAt(index_type aStart, size_type aCount, nsTArray_Impl<E, Alloc>::ReplaceElementsAt(index_type aStart, size_type aCount,
const Item* aArray, size_type aArrayLen) -> elem_type* const Item* aArray, size_type aArrayLen) -> elem_type*
{ {
if (MOZ_UNLIKELY(aStart > Length())) {
InvalidArrayIndex_CRASH(aStart, Length());
}
if (MOZ_UNLIKELY(aCount > Length() - aStart)) {
InvalidArrayIndex_CRASH(aStart + aCount, Length());
}
// Adjust memory allocation up-front to catch errors. // Adjust memory allocation up-front to catch errors.
if (!ActualAlloc::Successful(this->template EnsureCapacity<ActualAlloc>( if (!ActualAlloc::Successful(this->template EnsureCapacity<ActualAlloc>(
Length() + aArrayLen - aCount, sizeof(elem_type)))) { Length() + aArrayLen - aCount, sizeof(elem_type)))) {