From 678c68a2aac90f50eadba99955731650b675fa81 Mon Sep 17 00:00:00 2001
From: "tao%netscape.com"
 <tao%netscape.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Fri, 27 Aug 1999 21:11:35 +0000
Subject: [PATCH] Patch to bug 11724. Fix suspec`ious buffer overrun problem.
 It prevents double byte Ja texts in DTD being loaded correctly.

git-svn-id: svn://10.0.0.236/trunk@44887 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/htmlparser/src/nsExpatTokenizer.cpp   | 19 ++++++++++++++-----
 .../htmlparser/src/nsExpatTokenizer.cpp       | 19 ++++++++++++++-----
 2 files changed, 28 insertions(+), 10 deletions(-)

diff --git a/mozilla/htmlparser/src/nsExpatTokenizer.cpp b/mozilla/htmlparser/src/nsExpatTokenizer.cpp
index 89e3a92414e..19f8ec538a4 100644
--- a/mozilla/htmlparser/src/nsExpatTokenizer.cpp
+++ b/mozilla/htmlparser/src/nsExpatTokenizer.cpp
@@ -557,17 +557,26 @@ nsresult nsExpatTokenizer::LoadStream(nsIInputStream* in,
   if (NS_FAILED(res)) return res;
 
   PRUint32 aReadCount = 0;
-  uniBuf = (PRUnichar *) PR_Malloc(bufsize);
+  PRUnichar             *aBuf = (PRUnichar *) PR_Malloc(bufsize);
 
-  while (NS_OK == (res=uniIn->Read(uniBuf, retLen, aCount, &aReadCount))) {
-    retLen += aReadCount;
+  while (NS_OK == (res=uniIn->Read(aBuf, retLen, aCount, &aReadCount))) {
+  retLen += aReadCount;
+#if 1
+      bufsize += aCount * sizeof(PRUnichar);
+      aBuf = (PRUnichar *) PR_Realloc(aBuf, bufsize);
+#else
     if (((aReadCount+32) >= aCount) &&
-        ((retLen+aCount) >= bufsize)) {
+        ((retLen+aCount) * sizeof(PRUnichar) >= bufsize)) {
 
-      bufsize += aCount;
+      bufsize += aCount * sizeof(PRUnichar);
       uniBuf = (PRUnichar *) PR_Realloc(uniBuf, bufsize*sizeof(PRUnichar));
     }
+#endif
   }/* while */
+  uniBuf = (PRUnichar *) PR_Malloc(retLen*sizeof(PRUnichar));
+  nsCRT::memcpy(uniBuf, aBuf, sizeof(PRUnichar) * retLen);
+  PR_FREEIF(aBuf);      
+
   if (NS_BASE_STREAM_EOF == res)
     res = NS_OK;
   return res;
diff --git a/mozilla/parser/htmlparser/src/nsExpatTokenizer.cpp b/mozilla/parser/htmlparser/src/nsExpatTokenizer.cpp
index 89e3a92414e..19f8ec538a4 100644
--- a/mozilla/parser/htmlparser/src/nsExpatTokenizer.cpp
+++ b/mozilla/parser/htmlparser/src/nsExpatTokenizer.cpp
@@ -557,17 +557,26 @@ nsresult nsExpatTokenizer::LoadStream(nsIInputStream* in,
   if (NS_FAILED(res)) return res;
 
   PRUint32 aReadCount = 0;
-  uniBuf = (PRUnichar *) PR_Malloc(bufsize);
+  PRUnichar             *aBuf = (PRUnichar *) PR_Malloc(bufsize);
 
-  while (NS_OK == (res=uniIn->Read(uniBuf, retLen, aCount, &aReadCount))) {
-    retLen += aReadCount;
+  while (NS_OK == (res=uniIn->Read(aBuf, retLen, aCount, &aReadCount))) {
+  retLen += aReadCount;
+#if 1
+      bufsize += aCount * sizeof(PRUnichar);
+      aBuf = (PRUnichar *) PR_Realloc(aBuf, bufsize);
+#else
     if (((aReadCount+32) >= aCount) &&
-        ((retLen+aCount) >= bufsize)) {
+        ((retLen+aCount) * sizeof(PRUnichar) >= bufsize)) {
 
-      bufsize += aCount;
+      bufsize += aCount * sizeof(PRUnichar);
       uniBuf = (PRUnichar *) PR_Realloc(uniBuf, bufsize*sizeof(PRUnichar));
     }
+#endif
   }/* while */
+  uniBuf = (PRUnichar *) PR_Malloc(retLen*sizeof(PRUnichar));
+  nsCRT::memcpy(uniBuf, aBuf, sizeof(PRUnichar) * retLen);
+  PR_FREEIF(aBuf);      
+
   if (NS_BASE_STREAM_EOF == res)
     res = NS_OK;
   return res;