wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-29 11:57:32 +09:00
Code Issues Projects Releases Packages Wiki Activity

Perform a size check when dealing with clipboard data to be sure.

Browse source 
Follow-up to 0b6d9a47051be9ef4d064c6f7c60717da91d0bc2
This commit is contained in:
wolfbeast 2019-05-29 11:05:41 +02:00 • committed by Roy Tam
commit 5944b47f79
1 changed files with 10 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

16
widget/windows/nsClipboard.cpp
View file

@ -291,16 +291,20 @@ nsresult nsClipboard::GetGlobalData(HGLOBAL aHGBL, void ** aData, uint32_t * aLe
nsresult result = NS_ERROR_FAILURE; nsresult result = NS_ERROR_FAILURE;
if (aHGBL != nullptr) { if (aHGBL != nullptr) {
LPSTR lpStr = (LPSTR) GlobalLock(aHGBL); LPSTR lpStr = (LPSTR) GlobalLock(aHGBL);
DWORD allocSize = GlobalSize(aHGBL); CheckedInt<uint32_t> allocSize = CheckedInt<uint32_t>(GlobalSize(aHGBL)) + 3;
char* data = static_cast<char*>(malloc(allocSize + 3)); if (!allocSize.isValid()) {
return NS_ERROR_INVALID_ARG;
}
char* data = static_cast<char*>(malloc(allocSize.value()));
if ( data ) { if ( data ) {
memcpy ( data, lpStr, allocSize ); uint32_t size = allocSize.value() - 3;
data[allocSize] = data[allocSize + 1] = data[allocSize + 2] = memcpy(data, lpStr, size);
'\0'; // null terminate for safety // null terminate for safety
data[size] = data[size + 1] = data[size + 2] = '\0';
GlobalUnlock(aHGBL); GlobalUnlock(aHGBL);
*aData = data; *aData = data;
*aLen = allocSize; *aLen = size;
result = NS_OK; result = NS_OK;
} }