From 2cf2c14337e39c792c8dcbfc6aa13020b2acaefa Mon Sep 17 00:00:00 2001 From: "darin%meer.net" Date: Thu, 28 Jul 2005 22:19:37 +0000 Subject: [PATCH] fixes bug 301643 "Off-by-one in mar_consume_index" r+a=bsmedberg git-svn-id: svn://10.0.0.236/trunk@176812 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/modules/libmar/src/mar_read.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mozilla/modules/libmar/src/mar_read.c b/mozilla/modules/libmar/src/mar_read.c index df160a49e2e..8ae3a771da4 100644 --- a/mozilla/modules/libmar/src/mar_read.c +++ b/mozilla/modules/libmar/src/mar_read.c @@ -102,7 +102,7 @@ static int mar_consume_index(MarFile *mar, char **buf, const char *buf_end) { * PRUint32 offset (network byte order) * PRUint32 length (network byte order) * PRUint32 flags (network byte order) - * char name[N] + * char name[N] (where N >= 1) * char null_byte; */ PRUint32 offset; @@ -111,7 +111,7 @@ static int mar_consume_index(MarFile *mar, char **buf, const char *buf_end) { const char *name; int namelen; - if ((buf_end - *buf) < (int)(2*sizeof(PRUint32) + 2)) + if ((buf_end - *buf) < (int)(3*sizeof(PRUint32) + 2)) return -1; memcpy(&offset, *buf, sizeof(offset));