зеркало из https://github.com/mozilla/gecko-dev.git
Bug 117667: access past end of docshell child array. sr=jst, r=joki
This commit is contained in:
Родитель
6fa19767f3
Коммит
17c1fbaea0
|
@ -4293,7 +4293,13 @@ nsEventStateManager::GetNextDocShell(nsIDocShellTreeNode* aNode,
|
|||
{
|
||||
NS_ASSERTION(aNode, "null docshell");
|
||||
NS_ASSERTION(aResult, "null out pointer");
|
||||
PRInt32 numChildren = 0;
|
||||
|
||||
aNode->GetChildCount(&numChildren);
|
||||
if (numChildren == 0) {
|
||||
*aResult = nsnull;
|
||||
return;
|
||||
}
|
||||
aNode->GetChildAt(0, aResult);
|
||||
if (*aResult)
|
||||
return;
|
||||
|
@ -4311,6 +4317,12 @@ nsEventStateManager::GetNextDocShell(nsIDocShellTreeNode* aNode,
|
|||
PRInt32 childOffset = 0;
|
||||
curItem->GetChildOffset(&childOffset);
|
||||
nsCOMPtr<nsIDocShellTreeNode> parentNode = do_QueryInterface(parentItem);
|
||||
numChildren = 0;
|
||||
parentNode->GetChildCount(&numChildren);
|
||||
if (childOffset+1 >= numChildren) {
|
||||
*aResult = nsnull;
|
||||
return;
|
||||
}
|
||||
parentNode->GetChildAt(childOffset+1, aResult);
|
||||
if (*aResult)
|
||||
return;
|
||||
|
|
Загрузка…
Ссылка в новой задаче