зеркало из https://github.com/mozilla/gecko-dev.git
Bug #190079. Crasher. Check length of string before calling |Last| on it. r=jkeiser,sr=scc,a=roc
This commit is contained in:
Родитель
325390778a
Коммит
a999059dd4
|
@ -469,7 +469,7 @@ nsHTMLValue::ParseIntValue(const nsAString& aString,
|
||||||
|
|
||||||
// Even if the integer could not be parsed, it might just be "*"
|
// Even if the integer could not be parsed, it might just be "*"
|
||||||
tmp.CompressWhitespace(PR_TRUE, PR_TRUE);
|
tmp.CompressWhitespace(PR_TRUE, PR_TRUE);
|
||||||
if (tmp.Last() == '*' && tmp.Length() == 1) {
|
if (tmp.Length() == 1 && tmp.Last() == '*') {
|
||||||
// special case: HTML spec says a value '*' == '1*'
|
// special case: HTML spec says a value '*' == '1*'
|
||||||
// see http://www.w3.org/TR/html4/types.html#type-multi-length
|
// see http://www.w3.org/TR/html4/types.html#type-multi-length
|
||||||
// b=29061
|
// b=29061
|
||||||
|
|
|
@ -469,7 +469,7 @@ nsHTMLValue::ParseIntValue(const nsAString& aString,
|
||||||
|
|
||||||
// Even if the integer could not be parsed, it might just be "*"
|
// Even if the integer could not be parsed, it might just be "*"
|
||||||
tmp.CompressWhitespace(PR_TRUE, PR_TRUE);
|
tmp.CompressWhitespace(PR_TRUE, PR_TRUE);
|
||||||
if (tmp.Last() == '*' && tmp.Length() == 1) {
|
if (tmp.Length() == 1 && tmp.Last() == '*') {
|
||||||
// special case: HTML spec says a value '*' == '1*'
|
// special case: HTML spec says a value '*' == '1*'
|
||||||
// see http://www.w3.org/TR/html4/types.html#type-multi-length
|
// see http://www.w3.org/TR/html4/types.html#type-multi-length
|
||||||
// b=29061
|
// b=29061
|
||||||
|
|
Загрузка…
Ссылка в новой задаче