Bug 1383002 - Fix UAF in nsMIMEHeaderParamImpl::DecodeRFC5987Param. r=mcmanus, a=jcristau
authorTristan Bourvon <tbourvon@mozilla.com>
Fri, 21 Jul 2017 15:23:38 +0200
changeset 412071 f3b0db0e8b2d51eb79e7caa70a66276ba49271dc
parent 412070 90967f2f00f59e0126481be26e447039e3589701
child 412072 ed08245d52332cadf13498c0a88bcd1a0bd68d1d
push id7540
push userryanvm@gmail.com
push dateMon, 24 Jul 2017 12:29:10 +0000
treeherdermozilla-beta@f3b0db0e8b2d [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmcmanus, jcristau
bugs1383002
milestone55.0
Bug 1383002 - Fix UAF in nsMIMEHeaderParamImpl::DecodeRFC5987Param. r=mcmanus, a=jcristau MozReview-Commit-ID: 2tk9WwUCpsw
netwerk/mime/nsMIMEHeaderParamImpl.cpp
--- a/netwerk/mime/nsMIMEHeaderParamImpl.cpp
+++ b/netwerk/mime/nsMIMEHeaderParamImpl.cpp
@@ -819,18 +819,18 @@ nsMIMEHeaderParamImpl::DecodeRFC5987Para
                                           nsACString& aLang,
                                           nsAString& aResult)
 {
   nsAutoCString charset;
   nsAutoCString language;
   nsAutoCString value;
 
   uint32_t delimiters = 0;
-  const char *encoded = PromiseFlatCString(aParamVal).get();
-  const char *c = encoded;
+  const nsCString& encoded = PromiseFlatCString(aParamVal);
+  const char *c = encoded.get();
 
   while (*c) {
     char tc = *c++;
 
     if (tc == '\'') {
       // single quote
       delimiters++;
     } else if (((unsigned char)tc) >= 128) {