Bug 692817 - Potential math overflow in Base64.cpp, r=dbaron
authorBenjamin Smedberg <benjamin@smedbergs.us>
Fri, 30 Dec 2011 12:54:12 -0500
changeset 84808 aa47e51cbd8a84409b36979c6adae620a413a2e7
parent 84807 fca43c453bc4010b5a5c48cb1e6434b3486d768a
child 84809 0609a69f85a66fc6ea356482859dd8eed33994fa
push id805
push userakeybl@mozilla.com
push dateWed, 01 Feb 2012 18:17:35 +0000
treeherdermozilla-aurora@6fb3bf232436 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdbaron
bugs692817
milestone12.0a1
Bug 692817 - Potential math overflow in Base64.cpp, r=dbaron
xpcom/io/Base64.cpp
--- a/xpcom/io/Base64.cpp
+++ b/xpcom/io/Base64.cpp
@@ -193,17 +193,23 @@ EncodeInputStream(nsIInputStream *aInput
 {
   nsresult rv;
 
   if (!aCount) {
     rv = aInputStream->Available(&aCount);
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
-  PRUint32 count = (aCount + 2) / 3 * 4; // +2 due to integer math.
+  PRUint64 countlong =
+    (PRUint64(aCount) + 2) / 3 * 4; // +2 due to integer math.
+  if (countlong + aOffset > PR_UINT32_MAX)
+    return NS_ERROR_OUT_OF_MEMORY;
+
+  PRUint32 count = PRUint32(countlong);
+
   aDest.SetLength(count + aOffset);
   if (aDest.Length() != count + aOffset)
     return NS_ERROR_OUT_OF_MEMORY;
 
   EncodeInputStream_State<T> state;
   state.charsOnStack = 0;
   state.c[2] = '\0';
   state.buffer = aOffset + aDest.BeginWriting();