Verified Commit df123116 authored by Mike Hommey's avatar Mike Hommey Committed by ma1
Browse files

Bug 2029761 - Handle large values returned by strnlen as an error. a=RyanVM 

Original Revision: https://phabricator.services.mozilla.com/D303290

Differential Revision: https://phabricator.services.mozilla.com/D308936
parent 18daaf56

mozglue/misc/Printf.cpp

+4 −6
Changes for mozglue/misc/Printf.cpp: 4 added lines, 6 removed lines.
Original line number Diff line number Diff line
@@ -386,13 +386,11 @@ bool mozilla::PrintfTarget::cvt_s(const char* s, int width, int prec, 
  }



  // Limit string length by precision value

  int slen = int(strnlen(s, prec));

  if (0 < prec && prec < slen) {

    slen = prec;

  size_t slen = strnlen(s, size_t(prec));

  if (slen > INT_MAX) {

    return false;

  }



  // and away we go

  return fill2(s, slen, width, flags);

  return fill2(s, int(slen), width, flags);

}



/*

mozglue/misc/Printf.h

+1 −1
Changes for mozglue/misc/Printf.h: 1 added line, 1 removed line.
Original line number Diff line number Diff line
@@ -172,7 +172,7 @@ class MOZ_STACK_CLASS SprintfState final : private mozilla::PrintfTarget, 
    size_t newlen;



    off = mCur - mBase;

    if (off + len >= mMaxlen) {

    if (len >= mMaxlen - off) {

      /* Grow the buffer */

      newlen = mMaxlen + ((len > 32) ? len : 32);

      newbase = this->template maybe_pod_malloc<char>(newlen);