Fix for bug 554255 (Limit resource use to something sane). r=sicking, sr=jst.
authorPeter Van der Beken <peterv@propagandism.org>
Fri, 09 Apr 2010 18:59:09 +0200
changeset 40625 647dd06b64fef56a895748fd76aa206e1a0b0e71
parent 40624 f99c1af1e1c11f11307c8a84acbce3430cee26d5
child 40626 b1db3f3e3ac1af8010fca65e142622aaccedcdce
push idunknown
push userunknown
push dateunknown
reviewerssicking, jst
bugs554255
milestone1.9.3a5pre
Fix for bug 554255 (Limit resource use to something sane). r=sicking, sr=jst.
content/xslt/src/xslt/txNodeSorter.cpp
--- a/content/xslt/src/xslt/txNodeSorter.cpp
+++ b/content/xslt/src/xslt/txNodeSorter.cpp
@@ -173,17 +173,25 @@ txNodeSorter::sortNodeSet(txNodeSet* aNo
     txNodeSetContext* evalContext = new txNodeSetContext(aNodes, aEs);
     NS_ENSURE_TRUE(evalContext, NS_ERROR_OUT_OF_MEMORY);
 
     rv = aEs->pushEvalContext(evalContext);
     NS_ENSURE_SUCCESS(rv, rv);
 
     // Create and set up memoryblock for sort-values and indexarray
     PRUint32 len = static_cast<PRUint32>(aNodes->size());
-    void* mem = PR_Malloc(len * (sizeof(PRUint32) + mNKeys * sizeof(TxObject*)));
+
+    // Limit resource use to something sane.
+    PRUint32 itemSize = sizeof(PRUint32) + mNKeys * sizeof(TxObject*);
+    if (mNKeys > (PR_UINT32_MAX - sizeof(PRUint32)) / sizeof(TxObject*) ||
+        len >= PR_UINT32_MAX / itemSize) {
+        return NS_ERROR_OUT_OF_MEMORY;
+    }
+
+    void* mem = PR_Malloc(len * itemSize);
     NS_ENSURE_TRUE(mem, NS_ERROR_OUT_OF_MEMORY);
 
     PRUint32* indexes = static_cast<PRUint32*>(mem);
     TxObject** sortValues = reinterpret_cast<TxObject**>(indexes + len);
 
     PRUint32 i;
     for (i = 0; i < len; ++i) {
         indexes[i] = i;