Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-12-03 18:47:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Crash when reading past the end of a CSSRuleList. patch by Hixie (ian@hixie.ch). r=blake, glazman sr=jst

Browse Source
This commit is contained in:
blakeross%telocity.com 2001-03-19 22:12:12 +00:00
parent 1bdce9ce08
commit 1dba7198b2
2 changed files with 14 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
content/html/style/src/nsCSSStyleSheet.cpp
View File

@ -666,18 +666,18 @@ CSSRuleListImpl::Item(PRUint32 aIndex, nsIDOMCSSRule** aReturn)
nsresult result = NS_OK;
*aReturn = nsnull;
if (nsnull != mStyleSheet) {
if (mStyleSheet) {
result = mStyleSheet->EnsureUniqueInner(); // needed to ensure rules have correct parent
if (NS_SUCCEEDED(result)) {
nsICSSRule *rule;
nsCOMPtr<nsICSSRule> rule;
result = mStyleSheet->GetStyleRuleAt(aIndex, rule);
if (NS_OK == result) {
result = rule->QueryInterface(NS_GET_IID(nsIDOMCSSRule),
(void **)aReturn);
result = mStyleSheet->GetStyleRuleAt(aIndex, *getter_AddRefs(rule));
if (rule) {
result = CallQueryInterface(rule, aReturn);
mRulesAccessed = PR_TRUE; // signal to never share rules again
} else if (result == NS_ERROR_ILLEGAL_VALUE) {
result = NS_OK; // per spec: "Return Value ... null if ... not a valid index."
}
NS_RELEASE(rule);
}
}

14
layout/style/nsCSSStyleSheet.cpp
View File

@ -666,18 +666,18 @@ CSSRuleListImpl::Item(PRUint32 aIndex, nsIDOMCSSRule** aReturn)
nsresult result = NS_OK;
*aReturn = nsnull;
if (nsnull != mStyleSheet) {
if (mStyleSheet) {
result = mStyleSheet->EnsureUniqueInner(); // needed to ensure rules have correct parent
if (NS_SUCCEEDED(result)) {
nsICSSRule *rule;
nsCOMPtr<nsICSSRule> rule;
result = mStyleSheet->GetStyleRuleAt(aIndex, rule);
if (NS_OK == result) {
result = rule->QueryInterface(NS_GET_IID(nsIDOMCSSRule),
(void **)aReturn);
result = mStyleSheet->GetStyleRuleAt(aIndex, *getter_AddRefs(rule));
if (rule) {
result = CallQueryInterface(rule, aReturn);
mRulesAccessed = PR_TRUE; // signal to never share rules again
} else if (result == NS_ERROR_ILLEGAL_VALUE) {
result = NS_OK; // per spec: "Return Value ... null if ... not a valid index."
}
NS_RELEASE(rule);
}
}