From 87461cbd6add253e9a5d21ba73b562b1b4510e01 Mon Sep 17 00:00:00 2001 From: "badami%netscape.com" Date: Fri, 22 Mar 2002 08:50:35 +0000 Subject: [PATCH] crash on double-click of word in textfield after form submission Protect against invalid arguments getting passed into AppendText of PlainTextSerializer. bug 125037 r=bratell sr=jst a=scc patch=tmutreja@netscape.com git-svn-id: svn://10.0.0.236/trunk@117164 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/content/base/src/nsPlainTextSerializer.cpp | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/mozilla/content/base/src/nsPlainTextSerializer.cpp b/mozilla/content/base/src/nsPlainTextSerializer.cpp index 91ed1a9a654..ee33edb8c7f 100644 --- a/mozilla/content/base/src/nsPlainTextSerializer.cpp +++ b/mozilla/content/base/src/nsPlainTextSerializer.cpp @@ -242,6 +242,10 @@ nsPlainTextSerializer::AppendText(nsIDOMText* aText, if (mIgnoreAboveIndex != (PRUint32)kNotFound) { return NS_OK; } + + NS_ASSERTION(aStartOffset >= 0, "Negative start offset for text fragment!"); + if ( aStartOffset < 0 ) + return NS_ERROR_INVALID_ARG; NS_ENSURE_ARG(aText); @@ -256,7 +260,14 @@ nsPlainTextSerializer::AppendText(nsIDOMText* aText, content->GetText(&frag); if (frag) { - length = ((aEndOffset == -1) ? frag->GetLength() : aEndOffset) - aStartOffset; + PRInt32 endoffset = (aEndOffset == -1) ? frag->GetLength() : aEndOffset; + NS_ASSERTION(aStartOffset <= endoffset, "A start offset is beyond the end of the text fragment!"); + + length = endoffset - aStartOffset; + if (length <= 0) { + return NS_OK; + } + if (frag->Is2b()) { textstr.Assign(frag->Get2b() + aStartOffset, length); }