Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

crash on double-click of word in textfield after form submission

Browse Source 
Protect against invalid arguments getting passed into AppendText of PlainTextSerializer.
bug 125037 r=bratell sr=jst a=scc patch=tmutreja@netscape.com


git-svn-id: svn://10.0.0.236/trunk@117164 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
badami%netscape.com
2002-03-22 08:50:35 +00:00
parent 7c8761ab2b
commit 87461cbd6a
1 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
mozilla/content/base/src/nsPlainTextSerializer.cpp
View File

@@ -242,6 +242,10 @@ nsPlainTextSerializer::AppendText(nsIDOMText* aText,
if (mIgnoreAboveIndex != (PRUint32)kNotFound) {
return NS_OK;
}
NS_ASSERTION(aStartOffset >= 0, "Negative start offset for text fragment!");
if ( aStartOffset < 0 )
return NS_ERROR_INVALID_ARG;
NS_ENSURE_ARG(aText);
@@ -256,7 +260,14 @@ nsPlainTextSerializer::AppendText(nsIDOMText* aText,
content->GetText(&frag);
if (frag) {
length = ((aEndOffset == -1) ? frag->GetLength() : aEndOffset) - aStartOffset;
PRInt32 endoffset = (aEndOffset == -1) ? frag->GetLength() : aEndOffset;
NS_ASSERTION(aStartOffset <= endoffset, "A start offset is beyond the end of the text fragment!");
length = endoffset - aStartOffset;
if (length <= 0) {
return NS_OK;
}
if (frag->Is2b()) {
textstr.Assign(frag->Get2b() + aStartOffset, length);
}