From cbc48d4f51d3c2d565d77ef194ab1ce258ca88d1 Mon Sep 17 00:00:00 2001
From: "nhotta%netscape.com" <nhotta%netscape.com>
Date: Fri, 21 Mar 2003 00:23:12 +0000
Subject: [PATCH] Null terminate the punycode encoded string, bug 198437,
 r=shanjian, sr=darin.

---
 netwerk/dns/src/nsIDNService.cpp | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/netwerk/dns/src/nsIDNService.cpp b/netwerk/dns/src/nsIDNService.cpp
index 54e9508e9ad7..7f9ad7f6420a 100644
--- a/netwerk/dns/src/nsIDNService.cpp
+++ b/netwerk/dns/src/nsIDNService.cpp
@@ -232,7 +232,7 @@ static nsresult punycode(const char* prefix, const nsAString& in, nsACString& ou
   // (include null terminator)
   const PRUint32 kEncodedBufSize = kMaxDNSNodeLen * 20 / 8 + 1 + 1;  
   char encodedBuf[kEncodedBufSize];
-  punycode_uint encodedLength;
+  punycode_uint encodedLength = kEncodedBufSize;
 
   enum punycode_status status = punycode_encode(ucs4Len,
                                                 ucs4Buf,
@@ -240,9 +240,11 @@ static nsresult punycode(const char* prefix, const nsAString& in, nsACString& ou
                                                 &encodedLength,
                                                 encodedBuf);
 
-  if (punycode_success != status)
+  if (punycode_success != status ||
+      encodedLength >= kEncodedBufSize)
     return NS_ERROR_FAILURE;
 
+  encodedBuf[encodedLength] = '\0';
   out.Assign(nsDependentCString(prefix) + nsDependentCString(encodedBuf));
 
   return NS_OK;