The index section of a MAR archive file contains several fixed-length fields
and also variable-length names for each file in the archive, terminated by a
null byte. Since that makes the length of the index variable, the length of the
entire index is also provided in the file.
When libmar opens a file, it allocates a buffer with the length given in the
file and reads the index from the file into that buffer.
mar_consume_index() then parses the entire index from that copy,
trying to make sure it doesn't read past the buffer it was given.
The length of the buffer is given to mar_consume_index()
by providing it a pointer to one byte past the end of the buffer.
However, mar_consume_index() treats this pointer as pointing *to* the end.
Therefore, it is possible for a malformed MAR file (one where the stated length
is less than the real length) to trigger a read of one byte beyond the
allocated memory.
Fix this by failing the parse when we reach the buffer end pointer minus one,
instead of when we reach that address itself.
--HG--
extra : amend_source : 3001a5bc08e790251759418e014bbd7153b66d8a
The bulk of this commit was generated with a script, executed at the top
level of a typical source code checkout. The only non-machine-generated
part was modifying MFBT's moz.build to reflect the new naming.
# The main substitution.
find . -name '*.cpp' -o -name '*.cc' -o -name '*.h' -o -name '*.mm' -o -name '*.idl'| \
xargs perl -p -i -e '
s/nsRefPtr\.h/RefPtr\.h/g; # handle includes
s/nsRefPtr ?</RefPtr</g; # handle declarations and variables
'
# Handle a special friend declaration in gfx/layers/AtomicRefCountedWithFinalize.h.
perl -p -i -e 's/::nsRefPtr;/::RefPtr;/' gfx/layers/AtomicRefCountedWithFinalize.h
# Handle nsRefPtr.h itself, a couple places that define constructors
# from nsRefPtr, and code generators specially. We do this here, rather
# than indiscriminantly s/nsRefPtr/RefPtr/, because that would rename
# things like nsRefPtrHashtable.
perl -p -i -e 's/nsRefPtr/RefPtr/g' \
mfbt/nsRefPtr.h \
xpcom/glue/nsCOMPtr.h \
xpcom/base/OwningNonNull.h \
ipc/ipdl/ipdl/lower.py \
ipc/ipdl/ipdl/builtin.py \
dom/bindings/Codegen.py \
python/lldbutils/lldbutils/utils.py
# In our indiscriminate substitution above, we renamed
# nsRefPtrGetterAddRefs, the class behind getter_AddRefs. Fix that up.
find . -name '*.cpp' -o -name '*.h' -o -name '*.idl' | \
xargs perl -p -i -e 's/nsRefPtrGetterAddRefs/RefPtrGetterAddRefs/g'
if [ -d .git ]; then
git mv mfbt/nsRefPtr.h mfbt/RefPtr.h
else
hg mv mfbt/nsRefPtr.h mfbt/RefPtr.h
fi
--HG--
rename : mfbt/nsRefPtr.h => mfbt/RefPtr.h
In AccessibleCaretEventHub, it is not accurate to use APZ enabled to
determine whether to use long tap injector. On desktop browser, there's
no long tap events even if APZ is enabled. We should use a preference to
control that.
Since it's a fact the APZ on b2g has long tap events, we should use
preference to disable long tap injector so that when long tap events
stop dispatching to AccessibleCaretEventHub, we'll know immediately.
Delete SetUseAsyncPanZoom() usage in gtest since APZ is not related to
scrolling in AccessibleCaretEventHub.
--HG--
extra : commitid : KgAxEFNYaeb
extra : rebase_source : 1f0eb87354be8d97f946ea2b1f2a5425521bcf12
Add a new preference, clibboard.plainTextOnly.
1. On: we only support kUnicodeMIME in SetData/GetData.
2. Off: we can support different MIME types in SetData/GetData
BTW, "copy image" is dependent on non-text/rich text support, so this
menu item is also disabled after we turn the pref off.
The flags added in toolkit/locales/Makefile.in turn out not to be actually
used, so just remove that.
The remaining uses of XULPPFLAGS are to set debug flags depending on whether
MOZ_DEBUG is set or not. Just set a dedicated variable with the right value
from configure.
Note that this does not emulate the WebKit quirk of supporting
element.style["-webkit-animation"] or supporting the uppercase
element.style.WebkitAnimation (etc.) as opposed to the lowercase (and
enumerable) element.style.webkitAnimation.
Note that this also does not add aliases for transition or animation
events.
(Patch has been minorly tweaked by dholbert, with dbaron's approval.)
Timothy Nikkel
Hiroyuki Ikezoe
Morris Tseng
Jean-Yves Avenard
Steve Singer
Xidorn Quan
Ehsan Akhgari
Matt Howell
Jared Wein
Chris Pearce
Daniel Holbert
Wes Kocher
Nathan Froyd
Carsten "Tomcat" Book
Tom Tromey
Ting-Yu Lin
Benoit Girard
Boris Chiou
Milan Sreckovic
Catalin Badea
Mike Hommey
Ben Kelly
Tooru Fujisawa
Liang-Heng Chen
L. David Baron
Shu-yu Guo
Patrick McManus
Mason Chang
Benjamin Bouvier