Bug 1274837 - don't crash by accessing string beyond its length. r=masayuki
--- a/dom/base/nsPlainTextSerializer.cpp
+++ b/dom/base/nsPlainTextSerializer.cpp
@@ -1314,26 +1314,30 @@ nsPlainTextSerializer::AddToLine(const c
mCurrentLine.Length(), goodSpace);
if (goodSpace != NS_LINEBREAKER_NEED_MORE_TEXT &&
nsCRT::IsAsciiSpace(mCurrentLine.CharAt(goodSpace-1))) {
--goodSpace; // adjust the position since line breaker returns a position next to space
}
}
// fallback if the line breaker is unavailable or failed
if (!mLineBreaker) {
- goodSpace = mWrapColumn-prefixwidth;
- while (goodSpace >= 0 &&
- !nsCRT::IsAsciiSpace(mCurrentLine.CharAt(goodSpace))) {
- goodSpace--;
+ if (mCurrentLine.IsEmpty() || mWrapColumn < prefixwidth) {
+ goodSpace = NS_LINEBREAKER_NEED_MORE_TEXT;
+ } else {
+ goodSpace = std::min(mWrapColumn - prefixwidth, mCurrentLine.Length() - 1);
+ while (goodSpace >= 0 &&
+ !nsCRT::IsAsciiSpace(mCurrentLine.CharAt(goodSpace))) {
+ goodSpace--;
+ }
}
}
nsAutoString restOfLine;
if (goodSpace == NS_LINEBREAKER_NEED_MORE_TEXT) {
- // If we don't found a good place to break, accept long line and
+ // If we didn't find a good place to break, accept long line and
// try to find another place to break
goodSpace=(prefixwidth>mWrapColumn+1)?1:mWrapColumn-prefixwidth+1;
if (mLineBreaker) {
if ((uint32_t)goodSpace < mCurrentLine.Length())
goodSpace = mLineBreaker->Next(mCurrentLine.get(),
mCurrentLine.Length(), goodSpace);
if (goodSpace == NS_LINEBREAKER_NEED_MORE_TEXT)
goodSpace = mCurrentLine.Length();