From 177391dbade26898875b4d1849a95d48b9879577 Mon Sep 17 00:00:00 2001 From: "mrbkap%gmail.com" Date: Thu, 27 Apr 2006 00:20:27 +0000 Subject: [PATCH] Be paranoid about the given indices and never return a null DOM from the paste (in success conditions). bug 335609, r+sr=jst --- editor/libeditor/html/nsHTMLDataTransfer.cpp | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/editor/libeditor/html/nsHTMLDataTransfer.cpp b/editor/libeditor/html/nsHTMLDataTransfer.cpp index 3ccce19df9a7..a40f412510ad 100644 --- a/editor/libeditor/html/nsHTMLDataTransfer.cpp +++ b/editor/libeditor/html/nsHTMLDataTransfer.cpp @@ -2537,8 +2537,14 @@ nsresult nsHTMLEditor::CreateDOMFragmentFromPaste(const nsAString &aInputString, res = StripFormattingNodes(*outFragNode, PR_TRUE); NS_ENSURE_SUCCESS(res, res); - - *outEndNode = *outStartNode = contextLeaf; + + // If there was no context, then treat all of the data we did get as the + // pasted data. + if (contextLeaf) + *outEndNode = *outStartNode = contextLeaf; + else + *outEndNode = *outStartNode = *outFragNode; + *outStartOffset = 0; // get the infoString contents @@ -2555,6 +2561,8 @@ nsresult nsHTMLEditor::CreateDOMFragmentFromPaste(const nsAString &aInputString, while (num--) { (*outStartNode)->GetFirstChild(getter_AddRefs(tmp)); + if (!tmp) + return NS_ERROR_FAILURE; tmp.swap(*outStartNode); } @@ -2562,6 +2570,8 @@ nsresult nsHTMLEditor::CreateDOMFragmentFromPaste(const nsAString &aInputString, while (num--) { (*outEndNode)->GetLastChild(getter_AddRefs(tmp)); + if (!tmp) + return NS_ERROR_FAILURE; tmp.swap(*outEndNode); } }