Commit 243ddbd5 authored by Nika Layzell's avatar Nika Layzell
Browse files

Bug 1497246 - Release-check aCount for underflow in ReplaceElementsAt, r=mccr8 a=RyanVM

parent c5287a9e

xpcom/ds/nsTArray.h

+3 −0
Original line number Diff line number Diff line
@@ -2461,6 +2461,9 @@ auto nsTArray_Impl<E, Alloc>::ReplaceElementsAtInternal(index_type aStart, 
  if (MOZ_UNLIKELY(aStart > Length())) {

    InvalidArrayIndex_CRASH(aStart, Length());

  }

  if (MOZ_UNLIKELY(aCount > Length() - aStart)) {

    InvalidArrayIndex_CRASH(aStart + aCount, Length());

  }



  // Adjust memory allocation up-front to catch errors.

  if (!ActualAlloc::Successful(this->template EnsureCapacity<ActualAlloc>(