From 30ea99bee8cc576f211c4feffce4fed2516e987e Mon Sep 17 00:00:00 2001 From: "bratell%lysator.liu.se" Date: Wed, 26 Jul 2000 00:05:55 +0000 Subject: [PATCH] Bug 40027, reads past buffer in nsString::ToCString, r,a=waterson git-svn-id: svn://10.0.0.236/trunk@74784 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/string/obsolete/nsString.cpp | 2 +- mozilla/xpcom/ds/nsString.cpp | 2 +- mozilla/xpcom/string/obsolete/nsString.cpp | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/mozilla/string/obsolete/nsString.cpp b/mozilla/string/obsolete/nsString.cpp index 067b7073df4..21e016f5016 100644 --- a/mozilla/string/obsolete/nsString.cpp +++ b/mozilla/string/obsolete/nsString.cpp @@ -689,7 +689,7 @@ char* nsCString::ToCString(char* aBuf, PRUint32 aBufLength,PRUint32 anOffset) co CBufDescriptor theDescr(aBuf,PR_TRUE,aBufLength,0); nsCAutoString temp(theDescr); - temp.Assign(*this,aBufLength-1); + temp.Assign(*this, PR_MIN(mLength, aBufLength-1)); temp.mStr=0; } return aBuf; diff --git a/mozilla/xpcom/ds/nsString.cpp b/mozilla/xpcom/ds/nsString.cpp index 067b7073df4..21e016f5016 100644 --- a/mozilla/xpcom/ds/nsString.cpp +++ b/mozilla/xpcom/ds/nsString.cpp @@ -689,7 +689,7 @@ char* nsCString::ToCString(char* aBuf, PRUint32 aBufLength,PRUint32 anOffset) co CBufDescriptor theDescr(aBuf,PR_TRUE,aBufLength,0); nsCAutoString temp(theDescr); - temp.Assign(*this,aBufLength-1); + temp.Assign(*this, PR_MIN(mLength, aBufLength-1)); temp.mStr=0; } return aBuf; diff --git a/mozilla/xpcom/string/obsolete/nsString.cpp b/mozilla/xpcom/string/obsolete/nsString.cpp index 067b7073df4..21e016f5016 100644 --- a/mozilla/xpcom/string/obsolete/nsString.cpp +++ b/mozilla/xpcom/string/obsolete/nsString.cpp @@ -689,7 +689,7 @@ char* nsCString::ToCString(char* aBuf, PRUint32 aBufLength,PRUint32 anOffset) co CBufDescriptor theDescr(aBuf,PR_TRUE,aBufLength,0); nsCAutoString temp(theDescr); - temp.Assign(*this,aBufLength-1); + temp.Assign(*this, PR_MIN(mLength, aBufLength-1)); temp.mStr=0; } return aBuf;