From ef9e897f6bb0ee82085a9cf65df39d17bcc68fa4 Mon Sep 17 00:00:00 2001 From: "cata%netscape.com" Date: Tue, 13 Apr 1999 00:08:26 +0000 Subject: [PATCH] Bugfix for out of control growth of internal buffer under certain error conditions. git-svn-id: svn://10.0.0.236/trunk@27242 18797224-902f-48f8-a5cc-f745e15eee43 --- .../intl/uconv/ucvlatin/nsUCvLatinSupport.cpp | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/mozilla/intl/uconv/ucvlatin/nsUCvLatinSupport.cpp b/mozilla/intl/uconv/ucvlatin/nsUCvLatinSupport.cpp index 810d9fea085..0f1f288b96e 100644 --- a/mozilla/intl/uconv/ucvlatin/nsUCvLatinSupport.cpp +++ b/mozilla/intl/uconv/ucvlatin/nsUCvLatinSupport.cpp @@ -456,7 +456,12 @@ NS_IMETHODIMP nsDecoderSupport::Convert(const char * aSrc, if ((res == NS_OK_UDEC_MOREINPUT) && (bcw == 0)) { // not enough input to convert even a single char: repeat! - DoubleBuffer(); + if (mBufferLength <= 32) DoubleBuffer(); + else { + // somehow we got into an error state and the buffer is growing out of control + res = NS_ERROR_UNEXPECTED; + break; + } } else { if (bcr < buffLen) { // we didn't convert that residual data - unfill the buffer @@ -482,7 +487,15 @@ NS_IMETHODIMP nsDecoderSupport::Convert(const char * aSrc, if (res == NS_OK_UDEC_MOREINPUT) { bcr = srcEnd - src; // make sure buffer is large enough - while (bcr > mBufferCapacity) DoubleBuffer(); + while (bcr > mBufferCapacity) { + if (mBufferLength <= 32) DoubleBuffer(); + else { + // somehow we got into an error state and the buffer is growing out of control + res = NS_ERROR_UNEXPECTED; + break; + } + } + FillBuffer(&src, bcr); } }