Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 460713. Sanity-check the length. r+sr=jst, a=dveditz

Browse Source 
git-svn-id: svn://10.0.0.236/trunk@255070 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
bzbarsky%mit.edu
2008-11-17 16:06:48 +00:00
parent d11c3c44dd
commit 3a288960d4
1 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
mozilla/content/html/content/src/nsHTMLSelectElement.cpp
View File

@@ -720,24 +720,30 @@ nsHTMLSelectElement::GetLength(PRUint32* aLength)
return mOptions->GetLength(aLength);
}
#define MAX_DYNAMIC_SELECT_LENGTH 10000
NS_IMETHODIMP
nsHTMLSelectElement::SetLength(PRUint32 aLength)
{
nsresult rv=NS_OK;
PRUint32 curlen;
PRInt32 i;
PRUint32 i;
rv = GetLength(&curlen);
if (NS_FAILED(rv)) {
curlen = 0;
}
if (curlen && (curlen > aLength)) { // Remove extra options
for (i = (curlen - 1); (i >= (PRInt32)aLength) && NS_SUCCEEDED(rv); i--) {
rv = Remove(i);
if (curlen > aLength) { // Remove extra options
for (i = curlen; i > aLength && NS_SUCCEEDED(rv); --i) {
rv = Remove(i-1);
}
} else if (aLength) {
} else if (aLength > curlen) {
if (aLength > MAX_DYNAMIC_SELECT_LENGTH) {
return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
}
// This violates the W3C DOM but we do this for backwards compatibility
nsCOMPtr<nsINodeInfo> nodeInfo;
@@ -758,7 +764,7 @@ nsHTMLSelectElement::SetLength(PRUint32 aLength)
nsCOMPtr<nsIDOMNode> node(do_QueryInterface(element));
for (i = curlen; i < (PRInt32)aLength; i++) {
for (i = curlen; i < aLength; i++) {
nsCOMPtr<nsIDOMNode> tmpNode;
rv = AppendChild(node, getter_AddRefs(tmpNode));