diff --git a/mozilla/nsprpub/lib/libc/src/base64.c b/mozilla/nsprpub/lib/libc/src/base64.c index 234d60d8fbf..0f6127574f0 100644 --- a/mozilla/nsprpub/lib/libc/src/base64.c +++ b/mozilla/nsprpub/lib/libc/src/base64.c @@ -155,7 +155,13 @@ PL_Base64Encode if( (char *)0 == dest ) { - PRUint32 destlen = ((srclen + 2)/3) * 4; + PRUint32 destlen; + /* Ensure all PRUint32 values stay within range. */ + if( srclen > (PR_UINT32_MAX/4) * 3 ) + { + return (char *)0; + } + destlen = ((srclen + 2)/3) * 4; dest = (char *)PR_MALLOC(destlen + 1); if( (char *)0 == dest ) { @@ -403,7 +409,9 @@ PL_Base64Decode if( (char *)0 == dest ) { - PRUint32 destlen = ((srclen * 3) / 4); + /* The following computes ((srclen * 3) / 4) without overflow. */ + PRUint32 rem = srclen % 4; + PRUint32 destlen = (srclen / 4) * 3 + (rem * 3) / 4; dest = (char *)PR_MALLOC(destlen + 1); if( (char *)0 == dest ) { diff --git a/mozilla/nsprpub/lib/libc/src/strlen.c b/mozilla/nsprpub/lib/libc/src/strlen.c index 6c47677727b..5cbc2b7ab1d 100644 --- a/mozilla/nsprpub/lib/libc/src/strlen.c +++ b/mozilla/nsprpub/lib/libc/src/strlen.c @@ -53,7 +53,7 @@ PL_strlen(const char *str) * we don't have ultra long strings that overflow an int32 */ if( sizeof(PRUint32) < sizeof(size_t) ) - PR_ASSERT(l < 2147483647); + PR_ASSERT(l <= PR_INT32_MAX); return (PRUint32)l; }