Bug 1170809 - Improve the buffer size check in nsXMLHttpRequest::AppendToResponseText. r=ehsan

This commit is contained in:
Andrea Marchesini 2015-06-10 11:22:12 -04:00
Родитель c38427b998
Коммит 7b1847e7aa
1 изменённых файлов: 13 добавлений и 4 удалений

Просмотреть файл

@ -678,13 +678,20 @@ nsXMLHttpRequest::AppendToResponseText(const char * aSrcBuffer,
&destBufferLen); &destBufferLen);
NS_ENSURE_SUCCESS(rv, rv); NS_ENSURE_SUCCESS(rv, rv);
if (!mResponseText.SetCapacity(mResponseText.Length() + destBufferLen, fallible)) { CheckedInt32 neededCapacity = destBufferLen;
neededCapacity += mResponseText.Length();
if (!neededCapacity.isValid()) {
return NS_ERROR_OUT_OF_MEMORY;
}
if (!mResponseText.SetCapacity(neededCapacity.value(), fallible)) {
return NS_ERROR_OUT_OF_MEMORY; return NS_ERROR_OUT_OF_MEMORY;
} }
char16_t* destBuffer = mResponseText.BeginWriting() + mResponseText.Length(); char16_t* destBuffer = mResponseText.BeginWriting() + mResponseText.Length();
int32_t totalChars = mResponseText.Length(); CheckedInt32 totalChars = mResponseText.Length();
// This code here is basically a copy of a similar thing in // This code here is basically a copy of a similar thing in
// nsScanner::Append(const char* aBuffer, uint32_t aLen). // nsScanner::Append(const char* aBuffer, uint32_t aLen).
@ -697,9 +704,11 @@ nsXMLHttpRequest::AppendToResponseText(const char * aSrcBuffer,
MOZ_ASSERT(NS_SUCCEEDED(rv)); MOZ_ASSERT(NS_SUCCEEDED(rv));
totalChars += destlen; totalChars += destlen;
if (!totalChars.isValid()) {
return NS_ERROR_OUT_OF_MEMORY;
}
mResponseText.SetLength(totalChars); mResponseText.SetLength(totalChars.value());
return NS_OK; return NS_OK;
} }