Bug 517456 - Use PL_strnchr instead of PL_strchr since the buffer is not null-terminated. Examined by Wayne Mery. r=mbanner
authorHiroyuki Ikezoe <hiikezoe@mozilla-japan.org>
Wed, 16 Jan 2013 17:24:55 -0500
changeset 14725 78c6a5c0828750976cf50bd4121331fe0ad82328
parent 14724 1f96372e8f46770da41619239eaa74fc71323e34
child 14726 11dc139c9e5325351412136ab25e21f7428879e1
push id867
push userbugzilla@standard8.plus.com
push dateMon, 01 Apr 2013 20:44:27 +0000
treeherdercomm-beta@797726b8d244 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmbanner
bugs517456
Bug 517456 - Use PL_strnchr instead of PL_strchr since the buffer is not null-terminated. Examined by Wayne Mery. r=mbanner
mailnews/local/src/nsParseMailbox.cpp
--- a/mailnews/local/src/nsParseMailbox.cpp
+++ b/mailnews/local/src/nsParseMailbox.cpp
@@ -930,20 +930,21 @@ nsresult nsParseMailMessageState::StartN
   return ParseEnvelope (line, lineLength);
 }
 
 /* largely lifted from mimehtml.c, which does similar parsing, sigh...
 */
 nsresult nsParseMailMessageState::ParseHeaders ()
 {
   char *buf = m_headers.GetBuffer();
-  char *buf_end = buf + m_headers.GetBufferPos();
+  uint32_t buf_length = m_headers.GetBufferPos();
+  char *buf_end = buf + buf_length;
   while (buf < buf_end)
   {
-    char *colon = PL_strchr (buf, ':');
+    char *colon = PL_strnchr(buf, ':', buf_length);
     char *end;
     char *value = 0;
     struct message_header *header = 0;
     struct message_header receivedBy;
 
     if (! colon)
       break;