wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-08-15 08:53:07 +09:00
Code Issues Projects Releases Packages Wiki Activity

[html parser] Check for integer overflow when computing new buffer sizes.

Browse source
This commit is contained in:
Moonchild 2021-02-24 09:57:24 +00:00 • committed by roytam1
commit 5934c74a3f
7 changed files with 36 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

2
parser/html/nsHtml5MetaScanner.cpp
View file

@ -743,7 +743,7 @@ void
nsHtml5MetaScanner::addToBuffer(int32_t c)
{
if (strBufLen == strBuf.length) {
jArray<char16_t,int32_t> newBuf = jArray<char16_t,int32_t>::newJArray(strBuf.length + (strBuf.length << 1));
jArray<char16_t,int32_t> newBuf = jArray<char16_t,int32_t>::newJArray(nsHtml5Portability::checkedAdd(strBuf.length, (strBuf.length << 1)));
nsHtml5ArrayCopy::arraycopy(strBuf, newBuf, strBuf.length);
strBuf = newBuf;
}