From ea7416e665872464e0cc59ec3c5512513814056c Mon Sep 17 00:00:00 2001 From: "alqahira%ardisson.org" Date: Sat, 24 Jul 2010 21:03:45 +0000 Subject: [PATCH] Fix for bug 554255 (Limit resource use to something sane). Patch by Peter Van der Beken , r=sicking, sr=jst, a1.9.0.next=dveditz git-svn-id: svn://10.0.0.236/trunk@260878 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/content/xslt/src/xslt/txNodeSorter.cpp | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/mozilla/content/xslt/src/xslt/txNodeSorter.cpp b/mozilla/content/xslt/src/xslt/txNodeSorter.cpp index 8f52a2d8a02..75ad2b7b861 100644 --- a/mozilla/content/xslt/src/xslt/txNodeSorter.cpp +++ b/mozilla/content/xslt/src/xslt/txNodeSorter.cpp @@ -178,7 +178,15 @@ txNodeSorter::sortNodeSet(txNodeSet* aNodes, txExecutionState* aEs, // Create and set up memoryblock for sort-values and indexarray PRUint32 len = static_cast(aNodes->size()); - void* mem = PR_Malloc(len * (sizeof(PRUint32) + mNKeys * sizeof(TxObject*))); + + // Don't overflow when calculating the length of the sort buffer. + PRUint32 itemSize = sizeof(PRUint32) + mNKeys * sizeof(TxObject*); + if (mNKeys > (PR_UINT32_MAX - sizeof(PRUint32)) / sizeof(TxObject*) || + len >= PR_UINT32_MAX / itemSize) { + return NS_ERROR_OUT_OF_MEMORY; + } + + void* mem = PR_Malloc(len * itemSize); NS_ENSURE_TRUE(mem, NS_ERROR_OUT_OF_MEMORY); PRUint32* indexes = static_cast(mem);