Bug 1182599 - Check for corrupted delta array in UrlClassifier. r=francois

2015-07-14 09:37:12 +02:00
parent 633f6c5f41
commit 07a876cf4c
1 changed files with 3 additions and 0 deletions
--- a/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.cpp
+++ b/toolkit/components/url-classifier/nsUrlClassifierPrefixSet.cpp
@@ -322,6 +322,9 @@ nsUrlClassifierPrefixSet::LoadFromFd(AutoFDClose& fileFd)
    for (uint32_t i = 0; i < indexSize; i++) {
      uint32_t numInDelta = i == indexSize - 1 ? deltaSize - indexStarts[i]
                               : indexStarts[i + 1] - indexStarts[i];
+      if (numInDelta > DELTAS_LIMIT) {
+        return NS_ERROR_FILE_CORRUPTED;
+      }
      if (numInDelta > 0) {
        mIndexDeltas[i].SetLength(numInDelta);
        mTotalPrefixes += numInDelta;