roytam1/palemoon27
1
0
Fork 0
mirror of https://github.com/roytam1/palemoon27.git synced 2026-05-26 13:23:07 +00:00
Code Issues Projects Releases Wiki Activity

Add sanity checks in nsScriptableUConv.cpp

Browse Source
This commit is contained in:
Pale Moon
2018-05-15 23:01:38 +02:00
committed by Roy Tam
parent dab4b4579c
commit 0d5ac5e0a7
1 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
intl/uconv/nsScriptableUConv.cpp
+14 -2
View File
@@ -11,6 +11,7 @@
#include "nsIUnicodeDecoder.h"
#include "nsIUnicodeEncoder.h"
#include "mozilla/dom/EncodingUtils.h"
#include "mozilla/CheckedInt.h"
using mozilla::dom::EncodingUtils;
@@ -39,7 +40,12 @@ nsScriptableUnicodeConverter::ConvertFromUnicodeWithLength(const nsAString& aSrc
const nsAFlatString& flatSrc = PromiseFlatString(aSrc);
rv = mEncoder->GetMaxLength(flatSrc.get(), inLength, aOutLen);
if (NS_SUCCEEDED(rv)) {
*_retval = (char*)moz_malloc(*aOutLen+1);
mozilla::CheckedInt<int32_t> needed(*aOutLen);
needed += 1;
if (!needed.isValid()) {
return NS_ERROR_OUT_OF_MEMORY;
}
*_retval = (char*)moz_malloc(needed.value());
if (!*_retval)
return NS_ERROR_OUT_OF_MEMORY;
@@ -151,7 +157,13 @@ nsScriptableUnicodeConverter::ConvertFromByteArray(const uint8_t* aData,
inLength, &outLength);
if (NS_SUCCEEDED(rv))
{
char16_t* buf = (char16_t*)moz_malloc((outLength+1)*sizeof(char16_t));
mozilla::CheckedInt<nsACString::size_type> needed(outLength);
needed += 1;
needed *= sizeof(char16_t);
if (!needed.isValid()) {
return NS_ERROR_OUT_OF_MEMORY;
}
char16_t* buf = (char16_t*)moz_malloc(needed.value());
if (!buf)
return NS_ERROR_OUT_OF_MEMORY;