bug 464998 - r+sr=bsmedberg, a=beltzner
authorDaniel Veditz <dveditz@cruzio.com>
Wed, 19 Nov 2008 11:55:59 -0500
changeset 21827 79948e2ddec5a11187b5f455119c4de5383518c5
parent 21826 73bda326879976ca31d6a26aa41892db80136ca6
child 21828 829fa2d1e9dca81e4936969958369a3f72568a8f
push id3701
push usertmielczarek@mozilla.com
push dateWed, 19 Nov 2008 17:15:52 +0000
treeherdermozilla-central@6b901a94228c [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbeltzner
bugs464998
milestone1.9.1b2pre
bug 464998 - r+sr=bsmedberg, a=beltzner
xpcom/io/nsEscape.cpp
--- a/xpcom/io/nsEscape.cpp
+++ b/xpcom/io/nsEscape.cpp
@@ -290,17 +290,17 @@ nsEscapeHTML2(const PRUnichar *aSourceBu
 {
   // if the caller didn't calculate the length
   if (aSourceBufferLen == -1) {
     aSourceBufferLen = nsCRT::strlen(aSourceBuffer); // ...then I will
   }
 
   /* XXX Hardcoded max entity len. */
   if (aSourceBufferLen >=
-      ((PR_UINT32_MAX / (6 * sizeof(PRUnichar))) + sizeof(PRUnichar)))
+      ((PR_UINT32_MAX - sizeof(PRUnichar)) / (6 * sizeof(PRUnichar))) )
     return nsnull;
 
   PRUnichar *resultBuffer = (PRUnichar *)nsMemory::Alloc(aSourceBufferLen *
                             6 * sizeof(PRUnichar) + sizeof(PRUnichar('\0')));
   PRUnichar *ptr = resultBuffer;
 
   if (resultBuffer) {
     PRInt32 i;