Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Patch to bug 11724. Fix suspec`ious buffer overrun problem. It prevents

Browse Source 
double byte Ja texts in DTD being loaded correctly.


git-svn-id: svn://10.0.0.236/trunk@44887 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
tao%netscape.com
1999-08-27 21:11:35 +00:00
parent 1f7c4b69f8
commit 678c68a2aa
2 changed files with 28 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
mozilla/htmlparser/src/nsExpatTokenizer.cpp
View File

@@ -557,17 +557,26 @@ nsresult nsExpatTokenizer::LoadStream(nsIInputStream* in,
if (NS_FAILED(res)) return res;
PRUint32 aReadCount = 0;
uniBuf = (PRUnichar *) PR_Malloc(bufsize);
PRUnichar *aBuf = (PRUnichar *) PR_Malloc(bufsize);
while (NS_OK == (res=uniIn->Read(uniBuf, retLen, aCount, &aReadCount))) {
retLen += aReadCount;
while (NS_OK == (res=uniIn->Read(aBuf, retLen, aCount, &aReadCount))) {
retLen += aReadCount;
#if 1
bufsize += aCount * sizeof(PRUnichar);
aBuf = (PRUnichar *) PR_Realloc(aBuf, bufsize);
#else
if (((aReadCount+32) >= aCount) &&
((retLen+aCount) >= bufsize)) {
((retLen+aCount) * sizeof(PRUnichar) >= bufsize)) {
bufsize += aCount;
bufsize += aCount * sizeof(PRUnichar);
uniBuf = (PRUnichar *) PR_Realloc(uniBuf, bufsize*sizeof(PRUnichar));
}
#endif
}/* while */
uniBuf = (PRUnichar *) PR_Malloc(retLen*sizeof(PRUnichar));
nsCRT::memcpy(uniBuf, aBuf, sizeof(PRUnichar) * retLen);
PR_FREEIF(aBuf);
if (NS_BASE_STREAM_EOF == res)
res = NS_OK;
return res;

19
mozilla/parser/htmlparser/src/nsExpatTokenizer.cpp
View File

@@ -557,17 +557,26 @@ nsresult nsExpatTokenizer::LoadStream(nsIInputStream* in,
if (NS_FAILED(res)) return res;
PRUint32 aReadCount = 0;
uniBuf = (PRUnichar *) PR_Malloc(bufsize);
PRUnichar *aBuf = (PRUnichar *) PR_Malloc(bufsize);
while (NS_OK == (res=uniIn->Read(uniBuf, retLen, aCount, &aReadCount))) {
retLen += aReadCount;
while (NS_OK == (res=uniIn->Read(aBuf, retLen, aCount, &aReadCount))) {
retLen += aReadCount;
#if 1
bufsize += aCount * sizeof(PRUnichar);
aBuf = (PRUnichar *) PR_Realloc(aBuf, bufsize);
#else
if (((aReadCount+32) >= aCount) &&
((retLen+aCount) >= bufsize)) {
((retLen+aCount) * sizeof(PRUnichar) >= bufsize)) {
bufsize += aCount;
bufsize += aCount * sizeof(PRUnichar);
uniBuf = (PRUnichar *) PR_Realloc(uniBuf, bufsize*sizeof(PRUnichar));
}
#endif
}/* while */
uniBuf = (PRUnichar *) PR_Malloc(retLen*sizeof(PRUnichar));
nsCRT::memcpy(uniBuf, aBuf, sizeof(PRUnichar) * retLen);
PR_FREEIF(aBuf);
if (NS_BASE_STREAM_EOF == res)
res = NS_OK;
return res;