Bug 1369913 - Better check of the buffer size in WebSocket. r=smaug, a=gchang
authorAndrea Marchesini <amarchesini@mozilla.com>
Mon, 12 Jun 2017 10:39:51 +0200
changeset 356012 f47eaebc0c5c5e9c7a7e75a67ce6ebb13325b5a1
parent 356011 012e4429ccd9f086da6f76d438267bd6ee92b63d
child 356013 40ce248a8c157f8022fbc4f15271a9f1133fa286
push id7178
push userryanvm@gmail.com
push dateWed, 28 Jun 2017 04:24:35 +0000
treeherdermozilla-esr52@0c8359ac6718 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssmaug, gchang
bugs1369913
milestone52.2.1
Bug 1369913 - Better check of the buffer size in WebSocket. r=smaug, a=gchang
dom/base/WebSocket.cpp
--- a/dom/base/WebSocket.cpp
+++ b/dom/base/WebSocket.cpp
@@ -5,16 +5,17 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "WebSocket.h"
 #include "mozilla/dom/WebSocketBinding.h"
 #include "mozilla/net/WebSocketChannel.h"
 
 #include "jsapi.h"
 #include "jsfriendapi.h"
+#include "mozilla/CheckedInt.h"
 #include "mozilla/DOMEventTargetHelper.h"
 #include "mozilla/net/WebSocketChannel.h"
 #include "mozilla/dom/File.h"
 #include "mozilla/dom/MessageEvent.h"
 #include "mozilla/dom/MessageEventBinding.h"
 #include "mozilla/dom/nsCSPContext.h"
 #include "mozilla/dom/nsCSPUtils.h"
 #include "mozilla/dom/ScriptSettings.h"
@@ -2494,17 +2495,24 @@ WebSocket::Send(nsIInputStream* aMsgStre
 
   int64_t readyState = ReadyState();
   if (readyState == CONNECTING) {
     aRv.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
     return;
   }
 
   // Always increment outgoing buffer len, even if closed
-  mOutgoingBufferedAmount += aMsgLength;
+  CheckedUint32 size = mOutgoingBufferedAmount;
+  size += aMsgLength;
+  if (!size.isValid()) {
+    aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
+    return;
+  }
+
+  mOutgoingBufferedAmount = size.value();
 
   if (readyState == CLOSING ||
       readyState == CLOSED) {
     return;
   }
 
   // We must have mImpl when connected.
   MOZ_ASSERT(mImpl);