Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-03-04 15:51:37 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Protect against an overly-large length. Patch from brendan, bug 335535, r=mrbkap

Browse Source
This commit is contained in:
mrbkap%gmail.com 2006-04-26 21:46:53 +00:00
parent 05a259f259
commit 0cf9f4ba99
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
js/src/jsstr.c
View File

@ -2066,6 +2066,11 @@ tagify(JSContext *cx, JSObject *obj, jsval *argv,
endlen = strlen(end);
taglen += JSSTRING_LENGTH(str) + 2 + endlen + 1; /* 'str</end>' */
if (taglen >= ~(size_t)0 / sizeof(jschar)) {
JS_ReportOutOfMemory(cx);
return JS_FALSE;
}
tagbuf = (jschar *) JS_malloc(cx, (taglen + 1) * sizeof(jschar));
if (!tagbuf)
return JS_FALSE;