Bommels05/Mozilla
Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bug 493664 off-by-ones, r=dougt, a=ss

Browse Source 
git-svn-id: svn://10.0.0.236/trunk@257358 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
dveditz%cruzio.com 2009-06-02 18:30:56 +00:00
parent e635cb06d9
commit 7ad5b772a1
1 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
mozilla/modules/libreg/src/reg.c
View File

@ -925,7 +925,7 @@ static REGERR nr_ReadName(REGFILE *reg, REGDESC *desc, uint32 buflen, char *buf)
XP_ASSERT(buflen > 0);
XP_ASSERT(buf);
if ( desc->namelen > buflen )
if ( buflen == 0 || desc->namelen > buflen )
return REGERR_BUFTOOSMALL;
err = nr_ReadFile(reg->fh, desc->name, desc->namelen, buf);
@ -1292,6 +1292,8 @@ static REGERR nr_NextName(const char *pPath, char *buf, uint32 bufsize, const ch
/* initialization and validation */
XP_ASSERT(buf);
if ( bufsize == 0 )
return REGERR_BUFTOOSMALL;
*newPath = NULL;
*buf = '\0';
@ -1314,9 +1316,8 @@ static REGERR nr_NextName(const char *pPath, char *buf, uint32 bufsize, const ch
/* copy first path segment into return buf */
while ( *pPath != '\0' && *pPath != PATHDEL )
{
if ( len == bufsize ) {
err = REGERR_NAMETOOLONG;
break;
if ( len == bufsize-1 ) {
return REGERR_NAMETOOLONG;
}
if ( *pPath < ' ' && *pPath > 0 )
return REGERR_BADNAME;
@ -1391,7 +1392,7 @@ static REGERR nr_ReplaceName(REGFILE *reg, REGOFF node, char *path, uint32 bufsi
XP_ASSERT(path);
len = XP_STRLEN(path);
if ( len > bufsize )
if ( len >= bufsize )
return REGERR_PARAM;
if ( len > 0 ) {
@ -3439,7 +3440,7 @@ VR_INTERFACE(REGERR) NR_RegEnumSubkeys( HREG hReg, RKEY key, REGENUM *state,
if ( err != REGERR_OK )
return err;
if ( key == 0 || state == NULL || buffer == NULL )
if ( key == 0 || state == NULL || buffer == NULL || bufsize == 0 )
return REGERR_PARAM;
reg = ((REGHANDLE*)hReg)->pReg;
@ -3654,7 +3655,7 @@ VR_INTERFACE(REGERR) NR_RegEnumEntries( HREG hReg, RKEY key, REGENUM *state,
if ( err != REGERR_OK )
return err;
if ( key == 0 || state == NULL || buffer == NULL )
if ( key == 0 || state == NULL || buffer == NULL || bufsize == 0 )
return REGERR_PARAM;
reg = ((REGHANDLE*)hReg)->pReg;