Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-02-10 17:24:29 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fixing bug 534666. Limit the length of a string in a text fragment. r=jonas@sicking.cc, sr=mrbkap@gmail.com

Browse Source
This commit is contained in:
Johnny Stenback 2010-04-09 15:55:11 -07:00
parent d18239a679
commit 2d424b5fc2
2 changed files with 22 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
content/base/src/nsGenericDOMDataNode.cpp
View File

@ -297,8 +297,7 @@ nsGenericDOMDataNode::SubstringData(PRUint32 aStart, PRUint32 aCount,
{
aReturn.Truncate();
// XXX add <0 checks if types change
PRUint32 textLength = PRUint32( mText.GetLength() );
PRUint32 textLength = mText.GetLength();
if (aStart > textLength) {
return NS_ERROR_DOM_INDEX_SIZE_ERR;
}
@ -366,6 +365,20 @@ nsGenericDOMDataNode::SetTextInternal(PRUint32 aOffset, PRUint32 aCount,
return NS_ERROR_DOM_INDEX_SIZE_ERR;
}
if (aCount > textLength - aOffset) {
aCount = textLength - aOffset;
}
PRUint32 endOffset = aOffset + aCount;
// Make sure the text fragment can hold the new data.
if (aLength > aCount && !mText.CanGrowBy(aLength - aCount)) {
// This exception isn't per spec, but the spec doesn't actually
// say what to do here.
return NS_ERROR_DOM_DOMSTRING_SIZE_ERR;
}
nsIDocument *document = GetCurrentDoc();
mozAutoDocUpdate updateBatch(document, UPDATE_CONTENT_MODEL, aNotify);
@ -379,12 +392,6 @@ nsGenericDOMDataNode::SetTextInternal(PRUint32 aOffset, PRUint32 aCount,
oldValue = GetCurrentValueAtom();
}
PRUint32 endOffset = aOffset + aCount;
if (endOffset > textLength) {
aCount = textLength - aOffset;
endOffset = textLength;
}
if (aNotify) {
CharacterDataChangeInfo info = {
aOffset == textLength,
@ -412,10 +419,10 @@ nsGenericDOMDataNode::SetTextInternal(PRUint32 aOffset, PRUint32 aCount,
NS_ENSURE_TRUE(to, NS_ERROR_OUT_OF_MEMORY);
// Copy over appropriate data
if (0 != aOffset) {
if (aOffset) {
mText.CopyTo(to, 0, aOffset);
}
if (0 != aLength) {
if (aLength) {
memcpy(to + aOffset, aBuffer, aLength * sizeof(PRUnichar));
}
if (endOffset != textLength) {

5
content/base/src/nsTextFragment.h
View File

@ -146,6 +146,11 @@ public:
return mState.mLength;
}
PRBool CanGrowBy(size_t n) const
{
return n < (1 << 29) && mState.mLength + n < (1 << 29);
}
/**
* Change the contents of this fragment to be a copy of the given
* buffer.