Bug 1808182 - Use of uninitialised values originating from NS_GetComplexLineBreaks (in nsPangoBreaker.cpp). r=jfkthame.

NS_GetComplexLineBreaks (in nsPangoBreaker.cpp) adds elements of type
`PangoLogAttr` to an array with `attrBuffer.AppendElements(aLength + 1);`.
However, `PangoLogAttr` doesn't have a default constructor, so those elements
are uninitialised, and that eventually leaks back to the the caller,
`ComplexBreaker::GetBreaks` and are used in a couple of different places after
that.  This patch fixes that by manually zeroing out the new area.

Differential Revision: https://phabricator.services.mozilla.com/D165846
This commit is contained in:
Julian Seward 2023-01-03 10:40:34 +00:00
Родитель 0537813301
Коммит d71b143fb3
1 изменённых файлов: 4 добавлений и 1 удалений

Просмотреть файл

@ -14,12 +14,15 @@ void NS_GetComplexLineBreaks(const char16_t* aText, uint32_t aLength,
uint8_t* aBreakBefore) {
NS_ASSERTION(aText, "aText shouldn't be null");
memset(aBreakBefore, false, aLength * sizeof(uint8_t));
memset(aBreakBefore, uint8_t(false), aLength * sizeof(uint8_t));
AutoTArray<PangoLogAttr, 2000> attrBuffer;
// XXX(Bug 1631371) Check if this should use a fallible operation as it
// pretended earlier.
attrBuffer.AppendElements(aLength + 1);
// `PangoLogAttr` doesn't have a default constructor (it is a C struct), so
// we need to manually initialize the new elements. See bug 1808182.
memset(attrBuffer.Elements(), 0, attrBuffer.Length() * sizeof(PangoLogAttr));
NS_ConvertUTF16toUTF8 aUTF8(aText, aLength);