From de696ad4353b5e263d825e0795d8ebb9c62cb9f0 Mon Sep 17 00:00:00 2001 From: "alecf%netscape.com" Date: Sat, 12 Jan 2002 02:38:08 +0000 Subject: [PATCH] fix take 2 on bug 114134, crashes when reading utf8 strings from dtds/etc r=dbaron, sr=jag when multi-byte characters crossed a buffer boundary, we weren't correctly backing up and instead tried to decode the half-loaded utf8 character... in addition, our new "remainder" count was completely broken - we were adding the old remainder to the new remainder, when in fact we had just consumed the old remainder git-svn-id: svn://10.0.0.236/trunk@112010 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/xpcom/io/nsUnicharInputStream.cpp | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/mozilla/xpcom/io/nsUnicharInputStream.cpp b/mozilla/xpcom/io/nsUnicharInputStream.cpp index 0e586931a05..e09651757e7 100644 --- a/mozilla/xpcom/io/nsUnicharInputStream.cpp +++ b/mozilla/xpcom/io/nsUnicharInputStream.cpp @@ -247,6 +247,7 @@ PRInt32 UTF8InputStream::Fill(nsresult * aErrorCode) // Now convert as much of the byte buffer to unicode as possible PRInt32 srcLen = CountValidUTF8Bytes(mByteData->GetBuffer(),remainder + nb); + NS_ASSERTION( (remainder+nb >= srcLen), "cannot be longer than out buffer"); NS_ConvertUTF8toUCS2 unicodeValue(Substring(mByteData->GetBuffer(), @@ -264,7 +265,7 @@ PRInt32 UTF8InputStream::Fill(nsresult * aErrorCode) mUnicharDataOffset = 0; mUnicharDataLength = dstLen; - mByteDataOffset += srcLen; + mByteDataOffset = srcLen; return dstLen; } @@ -274,8 +275,10 @@ UTF8InputStream::CountValidUTF8Bytes(const char* aBuffer, PRInt32 aMaxBytes) { const char *c = aBuffer; const char *end = aBuffer + aMaxBytes; + const char *lastchar = c; // pre-initialize in case of 0-length buffer while (c < end && *c) { + lastchar = c; if (UTF8traits::isASCII(*c)) c++; else if (UTF8traits::is2byte(*c)) @@ -293,6 +296,8 @@ UTF8InputStream::CountValidUTF8Bytes(const char* aBuffer, PRInt32 aMaxBytes) break; // Otherwise we go into an infinite loop. But what happens now? } } + if (c > end) + c = lastchar; return c - aBuffer; }