Bug 1056919 - Crash in memcpy | mozilla::net::CacheFileChunk::OnDataRead(mozilla::net::CacheFileHandle*, char*, tag_nsresult). r=honzab, a=sledru
authorMichal Novotny <michal.novotny@gmail.com>
Tue, 16 Sep 2014 20:37:39 +0200
changeset 224889 52e09c968b30c28f54172bb9c8abcb0fb74796ff
parent 224888 a67e850f9376b0ca0bcfaf8864d6da6cd57ca1fa
child 224890 193ec5695bd9ee5c8192f7fabbec690bcb33b4ca
push id3979
push userraliiev@mozilla.com
push dateMon, 13 Oct 2014 16:35:44 +0000
treeherdermozilla-beta@30f2cc610691 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewershonzab, sledru
bugs1056919
milestone34.0a2
Bug 1056919 - Crash in memcpy | mozilla::net::CacheFileChunk::OnDataRead(mozilla::net::CacheFileHandle*, char*, tag_nsresult). r=honzab, a=sledru
netwerk/cache2/CacheFileChunk.cpp
--- a/netwerk/cache2/CacheFileChunk.cpp
+++ b/netwerk/cache2/CacheFileChunk.cpp
@@ -536,17 +536,17 @@ CacheFileChunk::OnDataRead(CacheFileHand
                   MOZ_CRASH("Unexpected error in validity map!");
                 }
                 memcpy(mBuf + invalidOffset, mRWBuf + invalidOffset,
                        invalidLength);
               }
               invalidOffset = mValidityMap[i].Offset() + mValidityMap[i].Len();
             }
             if (invalidOffset < mRWBufSize) {
-              invalidLength = invalidOffset - mRWBufSize;
+              invalidLength = mRWBufSize - invalidOffset;
               memcpy(mBuf + invalidOffset, mRWBuf + invalidOffset,
                      invalidLength);
             }
             mValidityMap.Clear();
 
             free(mRWBuf);
             mRWBuf = nullptr;
             mRWBufSize = 0;