From e43bdd309812307c1291e51f0a83fb7ff5722b47 Mon Sep 17 00:00:00 2001
From: "jgmyers%netscape.com"
 <jgmyers%netscape.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Sun, 1 Apr 2001 19:40:32 +0000
Subject: [PATCH] don't decode overlong UTF8 sequences: bug 29314 r=jag sr=scc

git-svn-id: svn://10.0.0.236/trunk@91007 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/string/obsolete/nsString2.cpp       | 17 ++++++++++++++++-
 mozilla/xpcom/string/obsolete/nsString2.cpp | 17 ++++++++++++++++-
 2 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/mozilla/string/obsolete/nsString2.cpp b/mozilla/string/obsolete/nsString2.cpp
index 1928d744d15..b85fdbe9af1 100644
--- a/mozilla/string/obsolete/nsString2.cpp
+++ b/mozilla/string/obsolete/nsString2.cpp
@@ -1743,27 +1743,33 @@ NS_ConvertUTF8toUCS2::Init( const char* aCString, PRUint32 aLength )
     }
 
     PRUint32 ucs4;
+    PRUint32 minUcs4;
     PRInt32 state = 0;
     
     if ( 0xC0 == (0xE0 & c) ) { // 2 bytes UTF8
       ucs4 = (PRUint32(c) << 6) & 0x000007C0L;
       state = 1;
+      minUcs4 = 0x00000080;
     }
     else if ( 0xE0 == (0xF0 & c) ) { // 3 bytes UTF8
       ucs4 = (PRUint32(c) << 12) & 0x0000F000L;
       state = 2;
+      minUcs4 = 0x00000800;
     }
     else if ( 0xF0 == (0xF8 & c) ) { // 4 bytes UTF8
       ucs4 = (PRUint32(c) << 18) & 0x001F0000L;
       state = 3;
+      minUcs4 = 0x00010000;
     }
     else if ( 0xF8 == (0xFC & c) ) { // 5 bytes UTF8
       ucs4 = (PRUint32(c) << 24) & 0x03000000L;
       state = 4;
+      minUcs4 = 0x00200000;
     }
     else if ( 0xFC == (0xFE & c) ) { // 6 bytes UTF8
       ucs4 = (PRUint32(c) << 30) & 0x40000000L;
       state = 5;
+      minUcs4 = 0x04000000;
     }
     else {
       NS_ERROR("not a UTF8 string");
@@ -1783,7 +1789,16 @@ NS_ConvertUTF8toUCS2::Init( const char* aCString, PRUint32 aLength )
       }
     }
 
-    if (ucs4 >= 0x00010000) {
+    if (ucs4 < minUcs4) {
+      // Overlong sequence
+      *out++ = 0xFFFD;
+    } else if (ucs4 >= 0xD800 && ucs4 <= 0xDFFF) {
+      // Surrogates
+      *out++ = 0xFFFD;
+    } else if (ucs4 == 0xFFFE || ucs4 == 0xFFFF) {
+      // Prohibited characters
+      *out++ = 0xFFFD;
+    } else if (ucs4 >= 0x00010000) {
       if (ucs4 >= 0x001F0000) {
         *out++ = 0xFFFD;
       }
diff --git a/mozilla/xpcom/string/obsolete/nsString2.cpp b/mozilla/xpcom/string/obsolete/nsString2.cpp
index 1928d744d15..b85fdbe9af1 100644
--- a/mozilla/xpcom/string/obsolete/nsString2.cpp
+++ b/mozilla/xpcom/string/obsolete/nsString2.cpp
@@ -1743,27 +1743,33 @@ NS_ConvertUTF8toUCS2::Init( const char* aCString, PRUint32 aLength )
     }
 
     PRUint32 ucs4;
+    PRUint32 minUcs4;
     PRInt32 state = 0;
     
     if ( 0xC0 == (0xE0 & c) ) { // 2 bytes UTF8
       ucs4 = (PRUint32(c) << 6) & 0x000007C0L;
       state = 1;
+      minUcs4 = 0x00000080;
     }
     else if ( 0xE0 == (0xF0 & c) ) { // 3 bytes UTF8
       ucs4 = (PRUint32(c) << 12) & 0x0000F000L;
       state = 2;
+      minUcs4 = 0x00000800;
     }
     else if ( 0xF0 == (0xF8 & c) ) { // 4 bytes UTF8
       ucs4 = (PRUint32(c) << 18) & 0x001F0000L;
       state = 3;
+      minUcs4 = 0x00010000;
     }
     else if ( 0xF8 == (0xFC & c) ) { // 5 bytes UTF8
       ucs4 = (PRUint32(c) << 24) & 0x03000000L;
       state = 4;
+      minUcs4 = 0x00200000;
     }
     else if ( 0xFC == (0xFE & c) ) { // 6 bytes UTF8
       ucs4 = (PRUint32(c) << 30) & 0x40000000L;
       state = 5;
+      minUcs4 = 0x04000000;
     }
     else {
       NS_ERROR("not a UTF8 string");
@@ -1783,7 +1789,16 @@ NS_ConvertUTF8toUCS2::Init( const char* aCString, PRUint32 aLength )
       }
     }
 
-    if (ucs4 >= 0x00010000) {
+    if (ucs4 < minUcs4) {
+      // Overlong sequence
+      *out++ = 0xFFFD;
+    } else if (ucs4 >= 0xD800 && ucs4 <= 0xDFFF) {
+      // Surrogates
+      *out++ = 0xFFFD;
+    } else if (ucs4 == 0xFFFE || ucs4 == 0xFFFF) {
+      // Prohibited characters
+      *out++ = 0xFFFD;
+    } else if (ucs4 >= 0x00010000) {
       if (ucs4 >= 0x001F0000) {
         *out++ = 0xFFFD;
       }