From 5dd2a2b2ace5a8c04015feaf7eff85d0ccfb672f Mon Sep 17 00:00:00 2001
From: "peterv%netscape.com"
 <peterv%netscape.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Tue, 27 May 2003 12:30:32 +0000
Subject: [PATCH] Fix for bug 203978 (Invalid read of size 4 const nsString
 FunctionCall::INVALID_PARAM_VALUE(NS_LITERAL_STRING("invalid parameter value
 for function: "));). r=Pike, sr=jst.

git-svn-id: svn://10.0.0.236/trunk@142941 18797224-902f-48f8-a5cc-f745e15eee43
---
 .../transformiix/source/xpath/Expr.h          | 21 ++++++----
 .../source/xpath/FunctionCall.cpp             | 42 +++++--------------
 .../source/xpath/StringFunctionCall.cpp       |  2 +-
 .../functions/txFormatNumberFunctionCall.cpp  |  3 ++
 4 files changed, 27 insertions(+), 41 deletions(-)

diff --git a/mozilla/extensions/transformiix/source/xpath/Expr.h b/mozilla/extensions/transformiix/source/xpath/Expr.h
index 04b8884513e..df364629175 100644
--- a/mozilla/extensions/transformiix/source/xpath/Expr.h
+++ b/mozilla/extensions/transformiix/source/xpath/Expr.h
@@ -107,10 +107,6 @@ public:
 class FunctionCall : public Expr {
 
 public:
-
-    static const nsString INVALID_PARAM_COUNT;
-    static const nsString INVALID_PARAM_VALUE;
-
     virtual ~FunctionCall();
 
     /**
@@ -125,13 +121,20 @@ public:
     **/
     nsresult addParam(Expr* aExpr);
 
-    /*
+    /**
+     * Check if the number of parameters falls within a range.
+     *
+     * @param aParamCountMin minimum number of required parameters.
+     * @param aParamCountMax maximum number of parameters. If aParamCountMax
+     *                       is negative the maximum number is not checked.
+     * @return boolean representing whether the number of parameters falls
+     *         within the expected range or not.
+     *
      * XXX txIEvalContext should be txIParseContest, bug 143291
      */
-    virtual MBool requireParams(int aParamCountMin, txIEvalContext* aContext);
-    virtual MBool requireParams(int aParamCountMin,
-                                int aParamCountMax,
-                                txIEvalContext* aContext);
+    virtual PRBool requireParams(PRInt32 aParamCountMin,
+                                 PRInt32 aParamCountMax,
+                                 txIEvalContext* aContext);
 
 protected:
 
diff --git a/mozilla/extensions/transformiix/source/xpath/FunctionCall.cpp b/mozilla/extensions/transformiix/source/xpath/FunctionCall.cpp
index f9439d57e20..b2c1744759e 100644
--- a/mozilla/extensions/transformiix/source/xpath/FunctionCall.cpp
+++ b/mozilla/extensions/transformiix/source/xpath/FunctionCall.cpp
@@ -32,12 +32,6 @@
  * This class represents a FunctionCall as defined by the XSL Working Draft
 **/
 
-const nsString FunctionCall::INVALID_PARAM_COUNT(
-        NS_LITERAL_STRING("invalid number of parameters for function: "));
-
-const nsString FunctionCall::INVALID_PARAM_VALUE(
-        NS_LITERAL_STRING("invalid parameter value for function: "));
-
 FunctionCall::FunctionCall()
 {
 }
@@ -134,37 +128,23 @@ NodeSet* FunctionCall::evaluateToNodeSet(Expr* aExpr, txIEvalContext* aContext)
     return (NodeSet*)exprResult;
 }
 
-/**
- * Called to check number of parameters
-**/
-MBool FunctionCall::requireParams (int paramCountMin,
-                                   int paramCountMax,
+PRBool FunctionCall::requireParams(PRInt32 aParamCountMin,
+                                   PRInt32 aParamCountMax,
                                    txIEvalContext* aContext)
 {
-    int argc = params.getLength();
-    if ((argc < paramCountMin) || (argc > paramCountMax)) {
-        nsAutoString err(INVALID_PARAM_COUNT);
+    PRInt32 argc = params.getLength();
+    if (argc < aParamCountMin ||
+        (aParamCountMax > -1 && argc > aParamCountMax)) {
+        nsAutoString err(NS_LITERAL_STRING("invalid number of parameters "
+                                           "for function: "));
         toString(err);
         aContext->receiveError(err, NS_ERROR_XPATH_INVALID_ARG);
-        return MB_FALSE;
-    }
-    return MB_TRUE;
-} //-- requireParams
 
-/**
- * Called to check number of parameters
-**/
-MBool FunctionCall::requireParams(int paramCountMin, txIEvalContext* aContext)
-{
-    int argc = params.getLength();
-    if (argc < paramCountMin) {
-        nsAutoString err(INVALID_PARAM_COUNT);
-        toString(err);
-        aContext->receiveError(err, NS_ERROR_XPATH_INVALID_ARG);
-        return MB_FALSE;
+        return PR_FALSE;
     }
-    return MB_TRUE;
-} //-- requireParams
+
+    return PR_TRUE;
+}
 
 /**
  * Returns the String representation of this NodeExpr.
diff --git a/mozilla/extensions/transformiix/source/xpath/StringFunctionCall.cpp b/mozilla/extensions/transformiix/source/xpath/StringFunctionCall.cpp
index 7d45d23130f..d19c279ef70 100644
--- a/mozilla/extensions/transformiix/source/xpath/StringFunctionCall.cpp
+++ b/mozilla/extensions/transformiix/source/xpath/StringFunctionCall.cpp
@@ -57,7 +57,7 @@ ExprResult* StringFunctionCall::evaluate(txIEvalContext* aContext)
     switch (mType) {
         case CONCAT:
         {
-            if (!requireParams(2, aContext))
+            if (!requireParams(2, -1, aContext))
                 return new StringResult(NS_LITERAL_STRING("error"));
                 
             nsAutoString resultStr;
diff --git a/mozilla/extensions/transformiix/source/xslt/functions/txFormatNumberFunctionCall.cpp b/mozilla/extensions/transformiix/source/xslt/functions/txFormatNumberFunctionCall.cpp
index 4a49b3960b2..c04feca0c6a 100644
--- a/mozilla/extensions/transformiix/source/xslt/functions/txFormatNumberFunctionCall.cpp
+++ b/mozilla/extensions/transformiix/source/xslt/functions/txFormatNumberFunctionCall.cpp
@@ -46,6 +46,9 @@
 
 #include "prdtoa.h"
 
+#define INVALID_PARAM_VALUE \
+    NS_LITERAL_STRING("invalid parameter value for function: ")
+
 const PRUnichar txFormatNumberFunctionCall::FORMAT_QUOTE = '\'';
 
 /*