Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-24 21:31:04 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1236923 - Check int for overflow. r=peterv

Browse Source
This commit is contained in:
Eric Rahm 2016-05-21 10:05:05 -07:00
parent ff177872a0
commit 5e7354d86b
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
parser/expat/lib/xmlparse.c
View File

@ -6286,6 +6286,9 @@ poolGrow(STRING_POOL *pool)
}
if (pool->blocks && pool->start == pool->blocks->s) {
int blockSize = (int)(pool->end - pool->start)*2;
if (blockSize < 0)
return XML_FALSE;
pool->blocks = (BLOCK *)
pool->mem->realloc_fcn(pool->blocks,
(offsetof(BLOCK, s)
@ -6300,10 +6303,17 @@ poolGrow(STRING_POOL *pool)
else {
BLOCK *tem;
int blockSize = (int)(pool->end - pool->start);
if (blockSize < 0)
return XML_FALSE;
if (blockSize < INIT_BLOCK_SIZE)
blockSize = INIT_BLOCK_SIZE;
else
blockSize *= 2;
if (blockSize < 0)
return XML_FALSE;
tem = (BLOCK *)pool->mem->malloc_fcn(offsetof(BLOCK, s)
+ blockSize * sizeof(XML_Char));
if (!tem)