Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-14 05:45:37 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

crash on double-click of word in textfield after form submission

Browse Source 
Protect against invalid arguments getting passed into AppendText of PlainTextSerializer.
bug 125037 r=bratell sr=jst a=scc patch=tmutreja@netscape.com
This commit is contained in:
badami%netscape.com 2002-03-22 08:50:35 +00:00
parent 9ddf341d4f
commit 863bc68d2d
1 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
content/base/src/nsPlainTextSerializer.cpp
View File

@ -242,6 +242,10 @@ nsPlainTextSerializer::AppendText(nsIDOMText* aText,
if (mIgnoreAboveIndex != (PRUint32)kNotFound) {
return NS_OK;
}
NS_ASSERTION(aStartOffset >= 0, "Negative start offset for text fragment!");
if ( aStartOffset < 0 )
return NS_ERROR_INVALID_ARG;
NS_ENSURE_ARG(aText);
@ -256,7 +260,14 @@ nsPlainTextSerializer::AppendText(nsIDOMText* aText,
content->GetText(&frag);
if (frag) {
length = ((aEndOffset == -1) ? frag->GetLength() : aEndOffset) - aStartOffset;
PRInt32 endoffset = (aEndOffset == -1) ? frag->GetLength() : aEndOffset;
NS_ASSERTION(aStartOffset <= endoffset, "A start offset is beyond the end of the text fragment!");
length = endoffset - aStartOffset;
if (length <= 0) {
return NS_OK;
}
if (frag->Is2b()) {
textstr.Assign(frag->Get2b() + aStartOffset, length);
}