From 21648d222423a697f46a7ce51c83c45e005b5235 Mon Sep 17 00:00:00 2001 From: "jst%mozilla.jstenback.com" Date: Tue, 8 Jun 2004 22:30:11 +0000 Subject: [PATCH] Fixing bug 245930. Don't crash if attempting to replace data past the end of a string. r=dbaron@dbaron.org, sr=darin@meer.net git-svn-id: svn://10.0.0.236/trunk@157612 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/xpcom/string/src/nsTSubstring.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/mozilla/xpcom/string/src/nsTSubstring.cpp b/mozilla/xpcom/string/src/nsTSubstring.cpp index 6c840cfbbab..378863e0824 100644 --- a/mozilla/xpcom/string/src/nsTSubstring.cpp +++ b/mozilla/xpcom/string/src/nsTSubstring.cpp @@ -426,6 +426,8 @@ nsTSubstring_CharT::Replace( index_type cutStart, size_type cutLength, const cha } } + cutStart = PR_MIN(cutStart, Length()); + ReplacePrep(cutStart, cutLength, length); if (length > 0) @@ -449,6 +451,8 @@ nsTSubstring_CharT::ReplaceASCII( index_type cutStart, size_type cutLength, cons } #endif + cutStart = PR_MIN(cutStart, Length()); + ReplacePrep(cutStart, cutLength, length); if (length > 0) @@ -467,6 +471,8 @@ nsTSubstring_CharT::Replace( index_type cutStart, size_type cutLength, const sub size_type length = tuple.Length(); + cutStart = PR_MIN(cutStart, Length()); + ReplacePrep(cutStart, cutLength, length); if (length > 0)