wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-08-15 08:53:07 +09:00
Code Issues Projects Releases Packages Wiki Activity

[html parser] Check for integer overflow when computing new buffer sizes.

Browse source
This commit is contained in:
Moonchild 2021-02-24 09:57:24 +00:00 • committed by roytam1
commit 5934c74a3f
7 changed files with 36 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

4
parser/html/nsHtml5Tokenizer.cpp
View file

@ -1,7 +1,7 @@
/*
* Copyright (c) 2005-2007 Henri Sivonen
* Copyright (c) 2007-2015 Mozilla Foundation
* Copyright (c) 2018-2020 Moonchild Productions
* Copyright (c) 2018-2021 Moonchild Productions
* Copyright (c) 2020 Binary Outcast
* Portions of comments Copyright 2004-2010 Apple Computer, Inc., Mozilla
* Foundation, and Opera Software ASA.
@ -249,7 +249,7 @@ nsHtml5Tokenizer::emitStrBuf()
void
nsHtml5Tokenizer::appendStrBuf(char16_t* buffer, int32_t offset, int32_t length)
{
int32_t newLen = strBufLen + length;
int32_t newLen = nsHtml5Portability::checkedAdd(strBufLen, length);
MOZ_ASSERT(newLen <= strBuf.length, "Previous buffer length insufficient.");
if (MOZ_UNLIKELY(strBuf.length < newLen)) {
if (MOZ_UNLIKELY(!EnsureBufferSpace(length))) {