Sanity-check in nsStandardURL::Deserialize(). r=mayhemer, a=RyanVM

Also add test for faulty nsStandardURL deserialization.

See Bug 1392739.
This commit is contained in:
Valentin Gosu 2018-06-05 16:37:34 +02:00 committed by Roy Tam
commit bfe6f25a2d
2 changed files with 19 additions and 1 deletions

View file

@ -3455,8 +3455,10 @@ FromIPCSegment(const nsACString& aSpec, const ipc::StandardURLSegment& aSegment,
return false;
}
CheckedInt<uint32_t> segmentLen = aSegment.position();
segmentLen += aSegment.length();
// Make sure the segment does not extend beyond the spec.
if (NS_WARN_IF(aSegment.position() + aSegment.length() > aSpec.Length())) {
if (NS_WARN_IF(!segmentLen.isValid() || segmentLen.value() > aSpec.Length())) {
return false;
}