Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-15 22:35:43 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1316634: Use CheckedInt before checking against maximum limits; r=luke

Browse Source 
MozReview-Commit-ID: J6AEd0sZk3o

--HG--
extra : rebase_source : 8058c7458d39b350cf0aae6b7470081396038c0c
This commit is contained in:
Benjamin Bouvier 2016-11-18 17:07:35 +01:00
parent 863402e536
commit f4ed6903f6
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
js/src/wasm/WasmValidate.cpp
View File

@ -892,11 +892,12 @@ DecodeFunctionSection(Decoder& d, ModuleEnvironment* env)
if (!d.readVarU32(&numDefs))
return d.fail("expected number of function definitions");
uint32_t numFuncs = env->funcSigs.length() + numDefs;
if (numFuncs > MaxFuncs)
CheckedInt<uint32_t> numFuncs = env->funcSigs.length();
numFuncs += numDefs;
if (!numFuncs.isValid() || numFuncs.value() > MaxFuncs)
return d.fail("too many functions");
if (!env->funcSigs.reserve(numFuncs))
if (!env->funcSigs.reserve(numFuncs.value()))
return false;
for (uint32_t i = 0; i < numDefs; i++) {
@ -1038,11 +1039,12 @@ DecodeGlobalSection(Decoder& d, GlobalDescVector* globals)
if (!d.readVarU32(&numDefs))
return d.fail("expected number of globals");
uint32_t numGlobals = globals->length() + numDefs;
if (numGlobals > MaxGlobals)
CheckedInt<uint32_t> numGlobals = globals->length();
numGlobals += numDefs;
if (!numGlobals.isValid() || numGlobals.value() > MaxGlobals)
return d.fail("too many globals");
if (!globals->reserve(numGlobals))
if (!globals->reserve(numGlobals.value()))
return false;
for (uint32_t i = 0; i < numDefs; i++) {