Bug 1056919 - crash in memcpy | mozilla::net::CacheFileChunk::OnDataRead(mozilla::net::CacheFileHandle*, char*, tag_nsresult), r=honzab

netwerk/cache2/CacheFileChunk.cpp

@@ -541,7 +541,7 @@ CacheFileChunk::OnDataRead(CacheFileHandle *aHandle, char *aBuf,
               invalidOffset = mValidityMap[i].Offset() + mValidityMap[i].Len();
             }
             if (invalidOffset < mRWBufSize) {
-              invalidLength = invalidOffset - mRWBufSize;
+              invalidLength = mRWBufSize - invalidOffset;
               memcpy(mBuf + invalidOffset, mRWBuf + invalidOffset,
                      invalidLength);
             }