From eb84710991252b0c03a8b378b001026518c36a46 Mon Sep 17 00:00:00 2001
From: "masayuki%d-toybox.com" <masayuki%d-toybox.com>
Date: Thu, 5 May 2005 07:16:26 +0000
Subject: [PATCH] bug 292723 pReconv->dwSize value is invalid. it makes cause
 crash on win9x at reconverting with ATOK. r=timeless, sr=bzbarsky, a=asa

---
 widget/src/windows/nsWindow.cpp | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/widget/src/windows/nsWindow.cpp b/widget/src/windows/nsWindow.cpp
index 838bbb60d50..c23f0d89a39 100644
--- a/widget/src/windows/nsWindow.cpp
+++ b/widget/src/windows/nsWindow.cpp
@@ -7056,8 +7056,14 @@ PRBool nsWindow::OnIMEReconvert(LPARAM aData, LRESULT *oResult, PRBool aUseUnico
       *oResult = sizeof(RECONVERTSTRING) + len;
     }
 
-    ::ZeroMemory(pReconv, sizeof(RECONVERTSTRING));
-    pReconv->dwSize            = sizeof(RECONVERTSTRING);
+    if (pReconv->dwSize < *oResult) {
+      *oResult = 0;
+      return PR_FALSE;
+    }
+
+    DWORD tmpSize = pReconv->dwSize;
+    ::ZeroMemory(pReconv, tmpSize);
+    pReconv->dwSize            = tmpSize;
     pReconv->dwVersion         = 0;
     pReconv->dwStrLen          = len;
     pReconv->dwStrOffset       = sizeof(RECONVERTSTRING);