mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-19 16:25:38 +00:00
Bug 1170809
- Improve the buffer size check in nsXMLHttpRequest::AppendToResponseText. r=ehsan, r=bz
This commit is contained in:
parent
926e7b839f
commit
5ba92998c5
@ -678,13 +678,18 @@ nsXMLHttpRequest::AppendToResponseText(const char * aSrcBuffer,
|
||||
&destBufferLen);
|
||||
NS_ENSURE_SUCCESS(rv, rv);
|
||||
|
||||
if (!mResponseText.SetCapacity(mResponseText.Length() + destBufferLen, fallible)) {
|
||||
uint32_t size = mResponseText.Length() + destBufferLen;
|
||||
if (size < destBufferLen) {
|
||||
return NS_ERROR_OUT_OF_MEMORY;
|
||||
}
|
||||
|
||||
if (!mResponseText.SetCapacity(size, fallible)) {
|
||||
return NS_ERROR_OUT_OF_MEMORY;
|
||||
}
|
||||
|
||||
char16_t* destBuffer = mResponseText.BeginWriting() + mResponseText.Length();
|
||||
|
||||
int32_t totalChars = mResponseText.Length();
|
||||
CheckedInt32 totalChars = mResponseText.Length();
|
||||
|
||||
// This code here is basically a copy of a similar thing in
|
||||
// nsScanner::Append(const char* aBuffer, uint32_t aLen).
|
||||
@ -697,9 +702,11 @@ nsXMLHttpRequest::AppendToResponseText(const char * aSrcBuffer,
|
||||
MOZ_ASSERT(NS_SUCCEEDED(rv));
|
||||
|
||||
totalChars += destlen;
|
||||
if (!totalChars.isValid()) {
|
||||
return NS_ERROR_OUT_OF_MEMORY;
|
||||
}
|
||||
|
||||
mResponseText.SetLength(totalChars);
|
||||
|
||||
mResponseText.SetLength(totalChars.value());
|
||||
return NS_OK;
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user