Bug 1342661 - Boundary check before assigning. r=valentin, a=ritu
authorDaniel Stenberg <daniel@haxx.se>
Mon, 06 Mar 2017 13:26:43 +0100
changeset 395089 a7744be94bea4581220cfce7c48e22fb96ac2bf3
parent 395088 7dfb1fe34ea5be93b23e8a6c077948ee84955c74
child 395090 3d46587f5dbedf38e8d45e88b021d12a35b25bf5
push id1468
push userasasaki@mozilla.com
push dateMon, 05 Jun 2017 19:31:07 +0000
treeherdermozilla-release@0641fc6ee9d1 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersvalentin, ritu
bugs1342661
milestone54.0a2
Bug 1342661 - Boundary check before assigning. r=valentin, a=ritu
netwerk/streamconv/converters/nsBinHexDecoder.cpp
--- a/netwerk/streamconv/converters/nsBinHexDecoder.cpp
+++ b/netwerk/streamconv/converters/nsBinHexDecoder.cpp
@@ -170,17 +170,19 @@ nsresult nsBinHexDecoder::ProcessNextSta
       mName.SetLength(c & 63);
       if (mName.Length() != (c & 63)) {
         /* XXX ProcessNextState/ProcessNextChunk aren't rv checked */
         mState = BINHEX_STATE_DONE;
       }
       break;
 
     case BINHEX_STATE_FNAME:
-      mName.BeginWriting()[mCount] = c;
+      if (mCount < mName.Length()) {
+        mName.BeginWriting()[mCount] = c;
+      }
 
       if (++mCount > mName.Length())
       {
         // okay we've figured out the file name....set the content type on the channel
         // based on the file name AND issue our delayed on start request....
 
         DetectContentType(aRequest, mName);
         // now propagate the on start request