From 795925d5f44e8f46731a9b6f5e17056be07f4bcc Mon Sep 17 00:00:00 2001 From: "dbaron%fas.harvard.edu" Date: Mon, 14 Oct 2002 23:49:48 +0000 Subject: [PATCH] Change sprintf to snprintf to avoid potential for buffer overflow. Untabify surrounding code. b=173837 r=heikki sr=bzbarsky a=rjesup git-svn-id: svn://10.0.0.236/trunk@131997 18797224-902f-48f8-a5cc-f745e15eee43 --- .../content/html/style/src/nsCSSParser.cpp | 82 ++++++++++--------- mozilla/layout/style/nsCSSParser.cpp | 82 ++++++++++--------- 2 files changed, 86 insertions(+), 78 deletions(-) diff --git a/mozilla/content/html/style/src/nsCSSParser.cpp b/mozilla/content/html/style/src/nsCSSParser.cpp index 570057dc024..7589efd15ff 100644 --- a/mozilla/content/html/style/src/nsCSSParser.cpp +++ b/mozilla/content/html/style/src/nsCSSParser.cpp @@ -2555,47 +2555,51 @@ PRBool CSSParserImpl::ParseColor(PRInt32& aErrorCode, nsCSSValue& aValue) // try 'xxyyzz' without '#' prefix for compatibility with IE and Nav4x (bug 23236 and 45804) if (mNavQuirkMode && !IsParsingCompoundProperty()) { - // - If the string starts with 'a-f', the nsCSSScanner builds the token - // as a eCSSToken_Ident and we can parse the string as a 'xxyyzz' RGB color. - // - If it only contains '0-9' digits, the token is a eCSSToken_Number and it - // must be converted back to a 6 characters string to be parsed as a RGB color. - // - If it starts with '0-9' and contains any 'a-f', the token is a eCSSToken_Dimension, - // the mNumber part must be converted back to a string and the mIdent part must be - // appended to that string so that the resulting string has 6 characters. - // Note: This is a hack for Nav compatibility. Do not attempt to simplify it - // by hacking into the ncCSSScanner. This would be very bad. - nsAutoString str; - char buffer[10]; - switch (tk->mType) { - case eCSSToken_Ident: - str.Assign(tk->mIdent); - break; + // - If the string starts with 'a-f', the nsCSSScanner builds the + // token as a eCSSToken_Ident and we can parse the string as a + // 'xxyyzz' RGB color. + // - If it only contains '0-9' digits, the token is a + // eCSSToken_Number and it must be converted back to a 6 + // characters string to be parsed as a RGB color. + // - If it starts with '0-9' and contains any 'a-f', the token is a + // eCSSToken_Dimension, the mNumber part must be converted back to + // a string and the mIdent part must be appended to that string so + // that the resulting string has 6 characters. + // Note: This is a hack for Nav compatibility. Do not attempt to + // simplify it by hacking into the ncCSSScanner. This would be very + // bad. + nsAutoString str; + char buffer[20]; + switch (tk->mType) { + case eCSSToken_Ident: + str.Assign(tk->mIdent); + break; - case eCSSToken_Number: - if (tk->mIntegerValid) { - sprintf(buffer, "%06d", tk->mInteger); - str.AssignWithConversion(buffer); - } - break; + case eCSSToken_Number: + if (tk->mIntegerValid) { + snprintf(buffer, sizeof(buffer), "%06d", tk->mInteger); + str.AssignWithConversion(buffer); + } + break; - case eCSSToken_Dimension: - if (tk->mIdent.Length() <= 6) { - sprintf(buffer, "%06.0f", tk->mNumber); - nsAutoString temp; - temp.AssignWithConversion(buffer); - temp.Right(str, 6 - tk->mIdent.Length()); - str.Append(tk->mIdent); - } - break; - default: - // There is a whole bunch of cases that are - // not handled by this switch. Ignore them. - break; - } - if (NS_HexToRGB(str, &rgba)) { - aValue.SetColorValue(rgba); - return PR_TRUE; - } + case eCSSToken_Dimension: + if (tk->mIdent.Length() <= 6) { + snprintf(buffer, sizeof(buffer), "%06.0f", tk->mNumber); + nsAutoString temp; + temp.AssignWithConversion(buffer); + temp.Right(str, 6 - tk->mIdent.Length()); + str.Append(tk->mIdent); + } + break; + default: + // There is a whole bunch of cases that are + // not handled by this switch. Ignore them. + break; + } + if (NS_HexToRGB(str, &rgba)) { + aValue.SetColorValue(rgba); + return PR_TRUE; + } } // It's not a color diff --git a/mozilla/layout/style/nsCSSParser.cpp b/mozilla/layout/style/nsCSSParser.cpp index 570057dc024..7589efd15ff 100644 --- a/mozilla/layout/style/nsCSSParser.cpp +++ b/mozilla/layout/style/nsCSSParser.cpp @@ -2555,47 +2555,51 @@ PRBool CSSParserImpl::ParseColor(PRInt32& aErrorCode, nsCSSValue& aValue) // try 'xxyyzz' without '#' prefix for compatibility with IE and Nav4x (bug 23236 and 45804) if (mNavQuirkMode && !IsParsingCompoundProperty()) { - // - If the string starts with 'a-f', the nsCSSScanner builds the token - // as a eCSSToken_Ident and we can parse the string as a 'xxyyzz' RGB color. - // - If it only contains '0-9' digits, the token is a eCSSToken_Number and it - // must be converted back to a 6 characters string to be parsed as a RGB color. - // - If it starts with '0-9' and contains any 'a-f', the token is a eCSSToken_Dimension, - // the mNumber part must be converted back to a string and the mIdent part must be - // appended to that string so that the resulting string has 6 characters. - // Note: This is a hack for Nav compatibility. Do not attempt to simplify it - // by hacking into the ncCSSScanner. This would be very bad. - nsAutoString str; - char buffer[10]; - switch (tk->mType) { - case eCSSToken_Ident: - str.Assign(tk->mIdent); - break; + // - If the string starts with 'a-f', the nsCSSScanner builds the + // token as a eCSSToken_Ident and we can parse the string as a + // 'xxyyzz' RGB color. + // - If it only contains '0-9' digits, the token is a + // eCSSToken_Number and it must be converted back to a 6 + // characters string to be parsed as a RGB color. + // - If it starts with '0-9' and contains any 'a-f', the token is a + // eCSSToken_Dimension, the mNumber part must be converted back to + // a string and the mIdent part must be appended to that string so + // that the resulting string has 6 characters. + // Note: This is a hack for Nav compatibility. Do not attempt to + // simplify it by hacking into the ncCSSScanner. This would be very + // bad. + nsAutoString str; + char buffer[20]; + switch (tk->mType) { + case eCSSToken_Ident: + str.Assign(tk->mIdent); + break; - case eCSSToken_Number: - if (tk->mIntegerValid) { - sprintf(buffer, "%06d", tk->mInteger); - str.AssignWithConversion(buffer); - } - break; + case eCSSToken_Number: + if (tk->mIntegerValid) { + snprintf(buffer, sizeof(buffer), "%06d", tk->mInteger); + str.AssignWithConversion(buffer); + } + break; - case eCSSToken_Dimension: - if (tk->mIdent.Length() <= 6) { - sprintf(buffer, "%06.0f", tk->mNumber); - nsAutoString temp; - temp.AssignWithConversion(buffer); - temp.Right(str, 6 - tk->mIdent.Length()); - str.Append(tk->mIdent); - } - break; - default: - // There is a whole bunch of cases that are - // not handled by this switch. Ignore them. - break; - } - if (NS_HexToRGB(str, &rgba)) { - aValue.SetColorValue(rgba); - return PR_TRUE; - } + case eCSSToken_Dimension: + if (tk->mIdent.Length() <= 6) { + snprintf(buffer, sizeof(buffer), "%06.0f", tk->mNumber); + nsAutoString temp; + temp.AssignWithConversion(buffer); + temp.Right(str, 6 - tk->mIdent.Length()); + str.Append(tk->mIdent); + } + break; + default: + // There is a whole bunch of cases that are + // not handled by this switch. Ignore them. + break; + } + if (NS_HexToRGB(str, &rgba)) { + aValue.SetColorValue(rgba); + return PR_TRUE; + } } // It's not a color