Bug 1056919 - Crash in memcpy | mozilla::net::CacheFileChunk::OnDataRead(mozilla::net::CacheFileHandle*, char*, tag_nsresult). r=honzab, a=sledru
authorMichal Novotny <michal.novotny@gmail.com>
Tue, 16 Sep 2014 20:37:39 +0200
changeset 217892 62d020eff8910d70e85d84be5b56dd84a4eeaacc
parent 217891 75eddbd6dc8084b7e8b201e3fd4ed958b35a459a
child 217893 e85a6d6891488309a313ac83b19765a4db89663b
push id515
push userraliiev@mozilla.com
push dateMon, 06 Oct 2014 12:51:51 +0000
treeherdermozilla-release@267c7a481bef [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewershonzab, sledru
bugs1056919
milestone33.0
Bug 1056919 - Crash in memcpy | mozilla::net::CacheFileChunk::OnDataRead(mozilla::net::CacheFileHandle*, char*, tag_nsresult). r=honzab, a=sledru
netwerk/cache2/CacheFileChunk.cpp
--- a/netwerk/cache2/CacheFileChunk.cpp
+++ b/netwerk/cache2/CacheFileChunk.cpp
@@ -536,17 +536,17 @@ CacheFileChunk::OnDataRead(CacheFileHand
                   MOZ_CRASH("Unexpected error in validity map!");
                 }
                 memcpy(mBuf + invalidOffset, mRWBuf + invalidOffset,
                        invalidLength);
               }
               invalidOffset = mValidityMap[i].Offset() + mValidityMap[i].Len();
             }
             if (invalidOffset < mRWBufSize) {
-              invalidLength = invalidOffset - mRWBufSize;
+              invalidLength = mRWBufSize - invalidOffset;
               memcpy(mBuf + invalidOffset, mRWBuf + invalidOffset,
                      invalidLength);
             }
             mValidityMap.Clear();
 
             free(mRWBuf);
             mRWBuf = nullptr;
             mRWBufSize = 0;