From 3c7ab8a384f12e1f4e5b0a54ed16bd603bd9fb57 Mon Sep 17 00:00:00 2001
From: Basilisk-Dev <basiliskdev@protonmail.com>
Date: Fri, 10 Apr 2026 14:31:54 -0400
Subject: [PATCH] Issue #3043 - Fix stack OOB write in
 nsLocaleService::GetLocaleFromAcceptLanguage bounds checks

---
 intl/locale/nsLocaleService.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/intl/locale/nsLocaleService.cpp b/intl/locale/nsLocaleService.cpp
index d81fb50c2e..562216eb57 100644
--- a/intl/locale/nsLocaleService.cpp
+++ b/intl/locale/nsLocaleService.cpp
@@ -289,7 +289,7 @@ nsLocaleService::GetLocaleFromAcceptLanguage(const char *acceptLanguage, nsILoca
         PR_sscanf(cPtr1,";q=%f",&qvalue[countLang]);
         *cPtr1 = '\0';
       }
-      if (strlen(cPtr)<NSILOCALE_MAX_ACCEPT_LANGUAGE) {     /* ignore if too long */
+      if (strlen(cPtr)<NSILOCALE_MAX_ACCEPT_LENGTH) {       /* ignore if too long */
         qvalue[countLang] -= (bias += 0.0001f); /* to insure original order */
         ptrLanguage[countLang++] = cPtr;
         if (countLang>=NSILOCALE_MAX_ACCEPT_LANGUAGE) break; /* quit if too many */
@@ -321,8 +321,8 @@ nsLocaleService::GetLocaleFromAcceptLanguage(const char *acceptLanguage, nsILoca
     cPtr = nsCRT::strtok(input.get(),",",&cPtr2);
     while (cPtr) {
       if (strlen(cPtr)<NSILOCALE_MAX_ACCEPT_LENGTH) {        /* ignore if too long */
+        if (countLang>=NSILOCALE_MAX_ACCEPT_LANGUAGE) break; /* quit if too many */
         PL_strncpyz(acceptLanguageList[countLang++],cPtr,NSILOCALE_MAX_ACCEPT_LENGTH);
-        if (countLang>=NSILOCALE_MAX_ACCEPT_LENGTH) break; /* quit if too many */
       }
       cPtr = nsCRT::strtok(cPtr2,",",&cPtr2);
     }