Bug 538891 - Possible overflow at CEnumFormatEtc::Next. r=jmathies.

This commit is contained in:
Kyle Huey 2010-01-10 18:32:28 -06:00
parent 55744c00f9
commit f35b20b502

View File

@ -121,12 +121,12 @@ CEnumFormatEtc::Next(ULONG aMaxToFetch, FORMATETC *aResult, ULONG *aNumFetched)
if (mCurrentIdx >= mFormatList.Length())
return S_FALSE;
PRInt32 left = mFormatList.Length() - mCurrentIdx;
PRUint32 left = mFormatList.Length() - mCurrentIdx;
if (!left || !aMaxToFetch)
if (!aMaxToFetch)
return S_FALSE;
PRInt32 count = NS_MIN(static_cast<PRInt32>(aMaxToFetch), left);
PRUint32 count = NS_MIN(static_cast<PRUint32>(aMaxToFetch), left);
PRUint32 idx = 0;
while (count > 0) {