Commit 0e630806 authored by Tooru Fujisawa's avatar Tooru Fujisawa Committed by Pier Angelo Vendrame
Browse files

Bug 2025947 - Check data corruption in script decompression. r=bthrall 

Differential Revision: https://phabricator.services.mozilla.com/D290360
parent 8d515d85

dom/script/ScriptCompression.cpp

+7 −0
Original line number Diff line number Diff line
@@ -137,6 +137,13 @@ bool ScriptBytecodeDecompress(Vector<uint8_t>& aCompressedBytecodeBuf, 
  PerfStats::AutoMetricRecording<PerfStats::Metric::JSBC_Decompression>

      autoRecording;



  if (aBytecodeOffset > aCompressedBytecodeBuf.length() ||

      aCompressedBytecodeBuf.length() - aBytecodeOffset <

          sizeof(ScriptBytecodeCompressedDataLayout::UncompressedLengthType)) {

    LOG(("ScriptLoadRequest: compressed buffer is corrupted and too short"));

    return false;

  }



  ScriptBytecodeDataLayout uncompressedLayout(aBytecodeBufOut, aBytecodeOffset);

  ScriptBytecodeCompressedDataLayout compressedLayout(

      aCompressedBytecodeBuf, uncompressedLayout.preludeLength());