Bug 1245866 - A better buffer size check in nsIDNService::IDNA2008ToUnicode, r=jfkthame
authorAndrea Marchesini <amarchesini@mozilla.com>
Tue, 16 Feb 2016 17:53:44 +0000
changeset 331328 b09f22c69916b7847306ec8757dc4ca14e5f560f
parent 331327 b29b876744e3dc0388b32234a78f75280a445817
child 331329 9a7112d0fae45e2812b16e7c792127ed5e491077
push id10956
push userjolesen@mozilla.com
push dateTue, 16 Feb 2016 19:12:12 +0000
reviewersjfkthame
bugs1245866
milestone47.0a1
Bug 1245866 - A better buffer size check in nsIDNService::IDNA2008ToUnicode, r=jfkthame
netwerk/dns/nsIDNService.cpp
--- a/netwerk/dns/nsIDNService.cpp
+++ b/netwerk/dns/nsIDNService.cpp
@@ -163,17 +163,17 @@ nsIDNService::~nsIDNService()
 #ifdef IDNA2008
 nsresult
 nsIDNService::IDNA2008ToUnicode(const nsACString& input, nsAString& output)
 {
   NS_ConvertUTF8toUTF16 inputStr(input);
   UIDNAInfo info = UIDNA_INFO_INITIALIZER;
   UErrorCode errorCode = U_ZERO_ERROR;
   int32_t inLen = inputStr.Length();
-  int32_t outMaxLen = inLen - kACEPrefixLen + 1;
+  int32_t outMaxLen = kMaxDNSNodeLen + 1;
   UChar outputBuffer[kMaxDNSNodeLen + 1];
 
   int32_t outLen = uidna_labelToUnicode(mIDNA, (const UChar*)inputStr.get(),
                                         inLen, outputBuffer, outMaxLen,
                                         &info, &errorCode);
   if (info.errors != 0) {
     return NS_ERROR_MALFORMED_URI;
   }