From be802e1b74f5d0f11a86180a4b6b8e5ffbe58f2e Mon Sep 17 00:00:00 2001
From: "jrgm%netscape.com"
 <jrgm%netscape.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Fri, 31 Jan 2003 01:34:45 +0000
Subject: [PATCH] Guard against bogus entries in the object map of the fastload
 file, bug 189832, r=ben/jag, sr=jst, a=asa

git-svn-id: svn://10.0.0.236/trunk@137173 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/xpcom/io/nsFastLoadFile.cpp | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/mozilla/xpcom/io/nsFastLoadFile.cpp b/mozilla/xpcom/io/nsFastLoadFile.cpp
index 414ce59c2ff..436ce2f04bc 100644
--- a/mozilla/xpcom/io/nsFastLoadFile.cpp
+++ b/mozilla/xpcom/io/nsFastLoadFile.cpp
@@ -852,6 +852,13 @@ nsFastLoadFileReader::ReadSharpObjectInfo(nsFastLoadSharpObjectInfo *aInfo)
     if (NS_FAILED(rv))
         return rv;
 
+    //XXXjrgm bug #189832 [temp. hack]; if an offset is zero, we've hit
+    // the bug and most abort fastload now.
+    NS_ASSERTION(aInfo->mCIDOffset != 0, 
+                 "fastload reader: Offset into file cannot be zero!");
+    if (aInfo->mCIDOffset == 0) 
+        return NS_ERROR_UNEXPECTED;
+
     rv = Read16(&aInfo->mStrongRefCnt);
     if (NS_FAILED(rv))
         return rv;
@@ -1624,6 +1631,11 @@ nsFastLoadFileWriter::WriteSharpObjectInfo(const nsFastLoadSharpObjectInfo& aInf
 {
     nsresult rv;
 
+    //XXXjrgm bug #189832 [temp. hack]; if an offset is zero, we've hit
+    // the bug. However, I'm not sure if we can safely abort at this point.
+    NS_ASSERTION(aInfo.mCIDOffset != 0, 
+                 "fastload writer: Offset into file cannot be zero!");
+
     rv = Write32(aInfo.mCIDOffset);
     if (NS_FAILED(rv))
         return rv;
@@ -1783,6 +1795,10 @@ nsFastLoadFileWriter::WriteFooter()
         new nsFastLoadSharpObjectInfo[footerPrefix.mNumSharpObjects];
     if (!objvec)
         return NS_ERROR_OUT_OF_MEMORY;
+    //XXXjrgm bug #189832 [temp. hack]; memset zero so I can catch bogus
+    // entries later
+    memset(objvec, 0, footerPrefix.mNumSharpObjects *
+                      sizeof(nsFastLoadSharpObjectInfo));
 
     count = PL_DHashTableEnumerate(&mObjectMap, ObjectMapEnumerate, objvec);
     NS_ASSERTION(count == footerPrefix.mNumSharpObjects,
@@ -2316,6 +2332,13 @@ nsFastLoadFileUpdater::Open(nsFastLoadFileReader* aReader)
     for (i = 0, n = aReader->mFooter.mNumSharpObjects; i < n; i++) {
         nsFastLoadFileReader::nsObjectMapEntry* readEntry = &readObjectMap[i];
 
+        //XXXjrgm bug #189832 [temp. hack]; if an offset is zero, we've hit
+        // the bug and most abort fastload now.
+        NS_ASSERTION(readEntry->mCIDOffset != 0,
+                     "fastload updater: Offset into file cannot be zero!");
+        if (readEntry->mCIDOffset == 0) 
+            return NS_ERROR_UNEXPECTED;
+
         nsISupports* obj = readEntry->mReadObject;
         NSFastLoadOID oid = MFL_SHARP_INDEX_TO_OID(i);
         void* key = obj