Bug 1307557 - Fix an out-of-bounds access in Element::DescribeAttribute(). r=dveditz
authorBotond Ballo <botond@mozilla.com>
Fri, 07 Oct 2016 15:12:00 -0400
changeset 318116 5cd71fa73ba0b316e3cca927a81802f5e01219c9
parent 318115 99a36fecb7ab1c6dc56647ec17cd0862ff57fe59
child 318117 19805d092001f47ba3d452066da4654e5380a27f
push id33211
push usercbook@mozilla.com
push dateMon, 17 Oct 2016 09:38:38 +0000
treeherderautoland@e4ef6fa03aa8 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdveditz
bugs1307557
milestone52.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1307557 - Fix an out-of-bounds access in Element::DescribeAttribute(). r=dveditz MozReview-Commit-ID: 15ItbWAQAPv
dom/base/Element.cpp
--- a/dom/base/Element.cpp
+++ b/dom/base/Element.cpp
@@ -2808,19 +2808,19 @@ Element::DescribeAttribute(uint32_t inde
 {
   // name
   mAttrsAndChildren.AttrNameAt(index)->GetQualifiedName(aOutDescription);
 
   // value
   aOutDescription.AppendLiteral("=\"");
   nsAutoString value;
   mAttrsAndChildren.AttrAt(index)->ToString(value);
-  for (int i = value.Length(); i >= 0; --i) {
-    if (value[i] == char16_t('"'))
-      value.Insert(char16_t('\\'), uint32_t(i));
+  for (uint32_t i = value.Length(); i > 0; --i) {
+    if (value[i - 1] == char16_t('"'))
+      value.Insert(char16_t('\\'), i - 1);
   }
   aOutDescription.Append(value);
   aOutDescription.Append('"');
 }
 
 #ifdef DEBUG
 void
 Element::ListAttributes(FILE* out) const